MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94bf4fcd5ae08ca59d02312f2f10b4501294a64baa78dbdca346590d54773ff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94bf4fcd5ae08ca59d02312f2f10b4501294a64baa78dbdca346590d54773ff4
SHA3-384 hash: 47a62cc6c9ac25bec8cbecb39fe42f767cab82053ec76c47f13ad4daedee696976d50839642f8f677cd74e99e0e617a6
SHA1 hash: e1c34ddb79e38ce0fd1ded238a086c5b1271ba90
MD5 hash: c4c024a17b1e01a7b13934ab1a5a4850
humanhash: edward-harry-sad-happy
File name:URGENT_QUOTATION_PR 270473.xlxs.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:379'879 bytes
First seen:2020-08-17 07:00:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:xhnMZZ8Hc4n0LREmzz93Z/GL3ltOZF7vLSJFprOuGFmrIW+z4EnpSXhTa+3P:xhMnnLR9hZ/GjltOZlLSJDrOu5rI/znO
TLSH FB8423434561CA4B8F20AB53A9996E03771E58BB8C1E07CFF1C862D1F157BF50EA462E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: paulaner.orion.rs
Sending IP: 77.105.37.159
From: GAN Phei Yun <phei-yun.gan@arkemas.com>
Subject: URGENT QUOTATION
Attachment: URGENT_QUOTATION_PR 270473.xlxs.zip (contains "URGENT_QUOTATION_PR #270473.xlxs.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PasswordStealer.GenericKDS.34374427.25093.26537.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94bf4fcd5ae08ca59d02312f2f10b4501294a64baa78dbdca346590d54773ff4/
Threat name:
ByteCode-MSIL.Hacktool.Mimikatz
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 07:02:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ss7u7tk24cgklhicgexs6efukajjjjslvj4nxxfdizmq2vdxh72a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94bf4fcd5ae08ca59d02312f2f10b4501294a64baa78dbdca346590d54773ff4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 94bf4fcd5ae08ca59d02312f2f10b4501294a64baa78dbdca346590d54773ff4

(this sample)

AgentTesla

Executable exe 53c2646413f8ad24c8faf0230527a207a163df8df788b45f36afe2d55210eb2d

  
Dropping
MD5 86fc98a0a100edc402bacbb5cdae261a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 53c2646413f8ad24c8faf0230527a207a163df8df788b45f36afe2d55210eb2d

Comments