MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7122cb64edc52abe8970efc389fa30aef082ef220e2c952d1f89e1f8001dc5c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: 7122cb64edc52abe8970efc389fa30aef082ef220e2c952d1f89e1f8001dc5c1
SHA1 hash: 341081899f081aa001a60d24d1a47db1c2ce8ded
MD5 hash: e6fada743aaf7561ef25f99e6633b8b3
File name:sam.exe
Download: download sample
Signature AgentTesla
File size:755'712 bytes
First seen:2020-05-23 11:13:44 UTC
Last seen:2020-05-23 11:46:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29d9aa9d7ab02ca63c870eb08d549a22
ssdeep 12288:XsybHd/zvDue757IRUPCYm+eQcFlxypu82quA+9dSp709es7o6ThGJDh1cppgPFF:c2xzvv7IRUP/eRFyp2qXai09FcWhkDhF
TLSH 3DF4AF22F2E14432D1A32A7D5C1B5F785C2EBD513A286A461BE45DCC9F3B781383629F
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: servers.com
Sending IP: 185.234.216.137
From: Christian Zeiler<secureserver@servers.com>
Subject: NEW ORDER PRODUCT
Attachment: NEW ORDER.zip (contains "sam.exe")

AgentTesla SMTP exfil server:
mail.shrc-india.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 22
Origin country US US
ClamAV PUA.Win.Adware.Slugin-6803969-0
PUA.Win.Adware.Slugin-6840354-0
VirusTotal:Virustotal results 48.61%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 7122cb64edc52abe8970efc389fa30aef082ef220e2c952d1f89e1f8001dc5c1

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments