MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7180c696cd1ba7b42913cbbcdbdb52631e568308d94cf7b36da1fed6c00b9278. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7180c696cd1ba7b42913cbbcdbdb52631e568308d94cf7b36da1fed6c00b9278
SHA3-384 hash: 4734aaee38e7409a71400fcf237241d0fcb8dbf5a61c36d1372ef47fd27fdb746d681054f1ad074564294b5396a5a3b4
SHA1 hash: 7dc76aceb65fb8c400521b09b0a3e2dcf4fc7d63
MD5 hash: 32bb42e3fc22a36b1ea958e0601fe076
humanhash: indigo-london-batman-sierra
File name:QUOTATION.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:540'523 bytes
First seen:2020-08-30 06:28:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9arPjWz+win5DwjFYKkG4S21zHKnxMj9PoO9kt/OI2QoscxS5p8Ox:9aricUFPSSWBBPRM2QojCp82
TLSH E3B423BAD56149C1A87314A4D6F031A4D7F7BCB2EA49D244483AE2D73C30163B794ABF
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gains.hificlouds.com
Sending IP: 131.153.48.114
From: sales@oilmarkntl.com
Subject: RE:OILMARK - INSTRUMENTATION-ELECTRICAL-SAFETY-AUTOMATION SUPPLIER **(QUOTATION)**
Attachment: QUOTATION.zip (contains "QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21711.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7180c696cd1ba7b42913cbbcdbdb52631e568308d94cf7b36da1fed6c00b9278/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 16:18:35 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ogamnfwndot3ikitzo6nxw2smmpfnayi3fgppm3nuh7nnqalsj4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7180c696cd1ba7b42913cbbcdbdb52631e568308d94cf7b36da1fed6c00b9278

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7180c696cd1ba7b42913cbbcdbdb52631e568308d94cf7b36da1fed6c00b9278

(this sample)

AgentTesla

Executable exe b7a6f698d55b81c17148ab01aa383457174788d2448d6a6df8e0d9db3c77dd12

  
Dropping
MD5 604108d0607c37fef45d876d0f4d834c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7a6f698d55b81c17148ab01aa383457174788d2448d6a6df8e0d9db3c77dd12

Comments