MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f96f26859a0e34567a6042ef891e59c27a62f6630d9211be0bbbcac749efe988. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: f96f26859a0e34567a6042ef891e59c27a62f6630d9211be0bbbcac749efe988
SHA1 hash: 35f57349d3755526e157509fbc5f6f1c3ee55225
MD5 hash: d36dbae8a914744662588288091d9e39
File name:JUNE_QUOTATION#7724_210520RFQ_NEW_OFFER_SAMPLE_AZN_O_M_Company.exe
Download: download sample
Signature AgentTesla
File size:446'976 bytes
First seen:2020-05-23 11:10:56 UTC
Last seen:2020-05-23 11:46:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:Rw79UPj0U3s6OHlwBT+1GXMMWihtHb+vqKqsXRufXM3P1:cI86+6ZnX+ih5qCKqzfX
TLSH EC940249329C626FD87C47F9286015520BB3AD42B652E34D4FE6B6EE16373E04A10EF3
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: juchansolutions.pw
Sending IP: 173.82.168.118
From: Saud Abdulaziz Khalaf Alsharrah <info@juchansolutions.pw>
Subject: JUNE QUOTATION
Attachment: JUNE_QUOTATION7724_210520RFQ_NEW_OFFER_SAMPLE_AZN_O_M_Company.arj (contains "JUNE_QUOTATION#7724_210520RFQ_NEW_OFFER_SAMPLE_AZN_O_M_Company.exe")

AgentTesla SMTP exfil server:
smtp.iotoils.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country FR FR
ClamAV SecuriteInfo.com.Trojan.Hosts.47613.21968.30777.UNOFFICIAL
VirusTotal:Virustotal results 31.94%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe f96f26859a0e34567a6042ef891e59c27a62f6630d9211be0bbbcac749efe988

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments