MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db6900a9d9f447304e6977adb54a453c98c73c1a0c8fefbe50f82ccd8b6ca53b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db6900a9d9f447304e6977adb54a453c98c73c1a0c8fefbe50f82ccd8b6ca53b
SHA3-384 hash: b7ade336a79bd0b6bd66ae133fc9a1b2bd6921b2813f013f45f4049d3e48aba19a70fb3ec1929d7a083c38b3f2bf53f4
SHA1 hash: b848c17520e9eddce26235c8445bfabe132ce0d3
MD5 hash: 3aecc6921a74e133f90d99d517093cb1
humanhash: failed-lithium-papa-december
File name:RFQ245665.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'133 bytes
First seen:2020-05-06 17:43:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:GQUA6aM5OeBFbYwSzwooXpSttBez+znPv1:GQUSMkOZRSxoXpqw+z1
TLSH DF94236BDD19784BA283242D0EF09B27DD85D26A07B0E3856C371FEC4CA4C8926D5E39
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tglostwax.com
Sending IP: 209.58.149.65
From: Jasir Aboobacker<chunyan.broemme@tglostwax.com>
Reply-To: Jasir Aboobacker<nicolasdiegonicolas@gmail.com>
Subject: REQUEST FOR QUOTATION - TOP URGENT
Attachment: RFQ245665.zip (contains "RFQ#245665.exe")

AgentTesla SMTP exfil server:
smtp.bapipl.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.8987.19246.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 18:36:40 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nuqbkoz6rdtattjo6w3kssfhsmmopa2bsh67psq7awm3c3muu5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip db6900a9d9f447304e6977adb54a453c98c73c1a0c8fefbe50f82ccd8b6ca53b

(this sample)

AgentTesla

Executable exe a1a3ed9d91fa4bc5c7a5bf1ef82c8bbc2893093b5d3534c8771805af914a16c2

  
Dropping
MD5 e1006ecf8f60d18583236270b93c4f07
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a1a3ed9d91fa4bc5c7a5bf1ef82c8bbc2893093b5d3534c8771805af914a16c2

Comments