MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08c1acc233ffbfbd00d3a1a96423dda03e9012ce04d064b56c6df47d0a4baa49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08c1acc233ffbfbd00d3a1a96423dda03e9012ce04d064b56c6df47d0a4baa49
SHA3-384 hash: 67704fd29d64ee657e42e947fe11463cf21c36d9da5b7d4d6f1d2801d952ddc8c0fe1f74214c1c44a6ddfe2649700f84
SHA1 hash: 35e8d896d6b70458f59ac2469fc452be82ab8529
MD5 hash: ac0b9fa3eaf901797a96e4c4a0b6b44c
humanhash: jersey-triple-lemon-colorado
File name:OC_Y9057241738.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'453 bytes
First seen:2020-05-19 14:24:44 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:Fm0BOZwbcqcZtcaxubMJrVZzmf+tGCBGqg7xYFq45sOx87CoARSe9EPtjSfkK5uZ:bMKgqSql6T6WtGCB0mXxsDe9EVjSfNEt
TLSH 6D84231340BDB9B5F96260C20B37B86080D684C27707EE2BB4BC8E79D6FD55E81369D9
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway21.websitewelcome.com
Sending IP: 192.185.45.163
From: Julia Gutierrez <aguerra@starlight.pe>
Subject: ORDEN DE COMPRA
Attachment: OC_Y9057241738.cab (contains "OC_Y9057241738.exe")

AgentTesla SMTP exfil server:
smtp.gfaqrochem.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47202.16268.6377.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 14:36:51 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bda2zqrt76732agtuguwii65ua7jaewoatigjnlmnx2h2cslvjeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 08c1acc233ffbfbd00d3a1a96423dda03e9012ce04d064b56c6df47d0a4baa49

(this sample)

AgentTesla

Executable exe bb8b06ada96296ed57372c977fd4279afd2d273cb3613080b243f15936c89096

  
Dropping
MD5 e9ed40cd41060913c64c2854b32709cc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb8b06ada96296ed57372c977fd4279afd2d273cb3613080b243f15936c89096

Comments