MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7dbae5489637762168c971777a5ea34067a669798ed833398025e0a49ff26bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7dbae5489637762168c971777a5ea34067a669798ed833398025e0a49ff26bd
SHA3-384 hash: 9089a5127799c84e9bde6a383f01ae42568ed84233b6fe0ccbfe165f5bb71a9798f7cb8b7c488b8b4705f4057506df98
SHA1 hash: 0690b9e9641da97e12640a7b2f524a616a2c5aed
MD5 hash: df873dea82e0ec3f92de3388dac0436a
humanhash: jersey-black-fix-twenty
File name:RFQ_56835586_supply.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'429 bytes
First seen:2020-06-15 12:39:13 UTC
Last seen:2020-06-16 23:42:57 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:fb2loXnoYzav1+cgox2l4IVYXhbvVQ4W5TtJmdECa:yloXnoEO19goxEKbvVw5YdE3
TLSH E484235417A93E92DFB3C3EF2BE28F1ABF78F255EC828245934CD12384E41559F05A85
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tpslmc.com
Sending IP: 103.114.104.116
From: PAUL CLINTON<cch.wirote@tpslmc.com>
Subject: RFQ_5856475_supplies
Attachment: RFQ_56835586_supply.z (contains "RFQ_56835586_supply.exe")

AgentTesla SMTP exfil server:
mail.sridurgaagros.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Sonbokli.Acl.11575.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:41:03 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w7n24vejmn3wefums4lxpjpkgqdhuzuxtdwygm4yajpausp7e26q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b7dbae5489637762168c971777a5ea34067a669798ed833398025e0a49ff26bd

(this sample)

AgentTesla

Executable exe 9702883830d4767241127d5112ebf1ed7c00731dc387d278f563d882347f2a6c

  
Dropping
MD5 8938463a5dfc03b08ee85ef8f64dcee5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9702883830d4767241127d5112ebf1ed7c00731dc387d278f563d882347f2a6c

Comments