MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5abfa80cf40d138887ae52cd441797c0e549af02c352f39451693cf597d184e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5abfa80cf40d138887ae52cd441797c0e549af02c352f39451693cf597d184e
SHA3-384 hash: 7dfd683f9fabd33b6a0993aeb1bb3720ff8a1953222e4755f498317b79b0e5ccb898ba6fa1bb0ba2395fd19c2e30641a
SHA1 hash: 28ee77564c4d5af3471dd3c430e719bf06ee8312
MD5 hash: 8dcbc0a2e5d101cb601b5f33869131f2
humanhash: king-papa-enemy-louisiana
File name:RFQ- PT MULYA MANDIRI NEW ORDER PO 02.27.20.doc.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'079'947 bytes
First seen:2020-06-20 07:44:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:+dmEB13oDdbyMeRup0q4LTWc+ix7odwOr37rDWTLTqnH6kUAaw:2hOdWfuptmTWI+eO/4OnHjPaw
TLSH 1CA5338C71CF91239DDBB39F892B180ECB8AE10216F3964EFC460A4BE6E38D4549D575
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: polystar-china.com
Sending IP: 103.99.1.149
From: Fiona<zhujin.tong@polystar-china.com>
Subject: RE: RFQ- PURCHASE ORDER 1x20 FCL SHIPMENT CIF TIANJIN FOR PT MULYA MANDIRI JAYA
Attachment: RFQ- PT MULYA MANDIRI NEW ORDER PO 02.27.20.doc.zip (contains "RFQ- PT MULYA MANDIRI NEW ORDER PO 02.27.20.doc.exe")

AgentTesla SMTP exfil server:
mail.parshavayealborz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25512.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 07:46:05 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ywv7vagpiditrcd24uwniqlzpqhfjgxqfq2s6okfc2j46wl5dbha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c5abfa80cf40d138887ae52cd441797c0e549af02c352f39451693cf597d184e

(this sample)

AgentTesla

Executable exe 1296fea5be2ddeca7afbb565183c83b9a5660eb1fe98942bb2f048be7b237f6c

  
Dropping
MD5 2a6cec53f04f431e88734606cc170575
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1296fea5be2ddeca7afbb565183c83b9a5660eb1fe98942bb2f048be7b237f6c

Comments