MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9002fa17aa421dea179c90df5cadb5c3a33b10f4069f832fc9740f4d1744e93b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9002fa17aa421dea179c90df5cadb5c3a33b10f4069f832fc9740f4d1744e93b
SHA3-384 hash: b508ede972796b4e930b183ed7968341f56814d49762b1243edc91ca6b6d2f0bfcc90eebc094eada32196452b3ab0ad7
SHA1 hash: bdb6603a716c2479940b8f3790a2c01099b044ca
MD5 hash: 070a4766b4d1ffb6fa9b97d6220bba07
humanhash: hydrogen-fifteen-floor-low
File name:Request for Quotation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'635 bytes
First seen:2020-06-25 08:51:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:B4wmX38GK2vUZ1sgY5I2dXxFW5a7uhEqN:B4H8ZZ1sgQxXbf7uqe
TLSH CA9423C60AD79E477B88B0610FA1DB1620B764FE9D48F37C03B8BA1A5135F9834525EE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp-out.malagasy.com
Sending IP: 41.204.120.178
From: operations@semad.mg
Subject: 540/S-20 AAY: N/D: 121/S/20 - INTERPHARMA MEDUL8134339 GP20MD0610 - DEPOTAGE CE LUNDI 15/06/2020 - RECTIF - RECLAMATION
Attachment: Request for Quotation.zip (contains "Request for Quotation.exe")

AgentTesla SMTP exfil server:
smtp.taiemerica.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.26029.17820.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9002fa17aa421dea179c90df5cadb5c3a33b10f4069f832fc9740f4d1744e93b/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sabpuf5kiio6uf44sdpvzlnvyortwehua2pygl6joqhu2f2e5e5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9002fa17aa421dea179c90df5cadb5c3a33b10f4069f832fc9740f4d1744e93b

(this sample)

AgentTesla

Executable exe e233ce7f095a6421cbf063354a29c51916131de74f35ae9ef6188c579cb16ad0

  
Dropping
MD5 cf65af377e66f46cca8559e0d9a97a0d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e233ce7f095a6421cbf063354a29c51916131de74f35ae9ef6188c579cb16ad0

Comments