🀲🏼 NEW | abuse.ch Community Hub! Earn recognition πŸ… for the malware intelligence you share, climb the leaderboards πŸ“ˆ, and connect with like-minded contributors who share your hunting focus 🀝. Ready to unlock your profile? Go to the Community Hub β†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a690f25aa7784c7ea6952f539aa505ad042afa79aa47dd20c596ed6ef6ec89e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a690f25aa7784c7ea6952f539aa505ad042afa79aa47dd20c596ed6ef6ec89e1
SHA3-384 hash: c46d478564b2b25eec71d2b00c937e649472bdf455506e686fc9b6da28866dd44c3f6a013c2346089b496a0993ec8b83
SHA1 hash: 4019514411e6feaa7d1a7d408126a5cf1d1364fa
MD5 hash: 2340c2725331ec32f02c87c145643e09
humanhash: kitten-table-rugby-ohio
File name:Revised Quotation 10049274.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:318'037 bytes
First seen:2020-07-13 11:26:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:nyPGfI1IUR6iM3XgQCoXKR68pymfeaT0Jr/OAurcWT0dVo/ZL:iB1zsjCdgrmfY8LT0To9
TLSH 906423440375D9B28E7226E771A9372BA5B1A77B4AFAC43AD8301F231ADD4762413DB0
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smail171.cn4e.com
Sending IP: 118.145.2.171
From: εŒ—δΊ¬δΈƒζ˜Ÿι£žθ‘Œη£ζζ°‘ε“ιƒ¨ <sales-cm@798.com.cn>
Subject: Re; Revised Quotation and confirm price in USD Asap !
Attachment: Revised Quotation 10049274.7z (contains "Order10049274pdf.exe")

AgentTesla SMTP exfil server:
webmail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.63723.24398.12064.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a690f25aa7784c7ea6952f539aa505ad042afa79aa47dd20c596ed6ef6ec89e1/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:27:07 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2ipewvhpbgh5juvf5jzvjifvuccv6tzvjd52igfs3ww55xmrhqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a690f25aa7784c7ea6952f539aa505ad042afa79aa47dd20c596ed6ef6ec89e1

(this sample)

AgentTesla

Executable exe 85d34a30b3163b6db32ec267c22e5fd5cbfab30533aa4a829f9d79ca55e779d2

  
Dropping
MD5 c71732b7a6d89bac55bf2f525c6a3a2f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85d34a30b3163b6db32ec267c22e5fd5cbfab30533aa4a829f9d79ca55e779d2

Comments