MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e64b4685b1b4b7594ada97cab3d8e293b0a54745e54eb482e207d3013ae4e427. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e64b4685b1b4b7594ada97cab3d8e293b0a54745e54eb482e207d3013ae4e427
SHA3-384 hash: c7b6caf8954a7fc9a144c65c7f0cb7169dbe4b8d0b551457f7b8986f0a8c05a05ea5f6e160f18a604398b40a8a6264d2
SHA1 hash: 1f0794c62925d618d57767a9039a89afe0840f22
MD5 hash: 593432e30696e927ff989fbeba159691
humanhash: maryland-sweet-mike-colorado
File name:Inquiry 40140.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:477'523 bytes
First seen:2020-08-13 08:33:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:tEEX1N0HkLZGuUbjinnd/UN7RNSXuB6oIg9c1uAtzDcW0u0Pps+CtNpphQWhozcj:q65G1bjinnd/QsuBZw1Ups+GwPzz9ID3
TLSH 0EA4231ABFD18EAAF356A612C7C3C898010451073AF39A5ECB5F456522F9A747FF482C
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bergers2b.com
Sending IP: 45.137.22.133
From: Nueket Yuerekli <NueketYuerekli@bergers2b.com>
Subject: RE: Quotation for Inquiry 40140
Attachment: Inquiry 40140.zip (contains "Inquiry 40140.exe")

AgentTesla SMTP exfil server:
smtp.ikrrispharmanetwork.com:587

AgentTesla SMTP exfil email address:
amazing.grace@ikrrispharmanetwork.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Mal.Generic-S.5549.16169.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e64b4685b1b4b7594ada97cab3d8e293b0a54745e54eb482e207d3013ae4e427/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 08:35:04 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zfunbnrws3vssw2s7flhwhcsoykkr2f4vhljaxca7jqcoxe4qtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e64b4685b1b4b7594ada97cab3d8e293b0a54745e54eb482e207d3013ae4e427

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e64b4685b1b4b7594ada97cab3d8e293b0a54745e54eb482e207d3013ae4e427

(this sample)

AgentTesla

Executable exe 6557f7ee32adfd50c44568fda13bd4591354c4f8d047815fd22ee67942d52bda

  
Dropping
MD5 cb2667d6821439de831b0ec242be35bd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6557f7ee32adfd50c44568fda13bd4591354c4f8d047815fd22ee67942d52bda

Comments