MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12d0c17f48c94113f57a2f09cc31476945c1dc3fdfdc6ffd31baebf4b1dbc3e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12d0c17f48c94113f57a2f09cc31476945c1dc3fdfdc6ffd31baebf4b1dbc3e8
SHA3-384 hash: 7bf690fa3c3c9075569de580186d3d3e5071d43558cb17ae7a5c8059ebcdc6e7f13bdac042e324f8b228eb4699438755
SHA1 hash: 86341624f7aac47dccd870257833400e90b718ef
MD5 hash: 26c8e45ecce910065f6b0c15da232e51
humanhash: pip-lion-winner-stream
File name:Miglior consiglio di pagamento globale PI CFL002 19A.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:573'633 bytes
First seen:2020-08-17 19:08:18 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:te5cCgub0eVr3jwGXiQdbL3+hgGKXwZY2vrleMJ0:tts3jwGyQF7+hgGKgZDTleM6
TLSH FFC423DE03E311104754AF71D0688BACCCBDBE69D07E39186894742DDE6B879EC5E22E
Reporter abuse_ch
Tags:AgentTesla geo gz ITA


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: artificialpark.com
Sending IP: 95.211.208.25
From: Cristina Sasso <sales15@artificialpark.com>
Subject: Miglior consiglio di pagamento globale // PI # CFL002 / 19A
Attachment: Miglior consiglio di pagamento globale PI CFL002 19A.gz (contains "Miglior consiglio di pagamento globale PI # CFL002 19A.exe")

AgentTesla SMTP exfil server:
smtp.dachanq.cc:587

AgentTesla SMTP exfil email address:
administrator@dachanq.cc

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12d0c17f48c94113f57a2f09cc31476945c1dc3fdfdc6ffd31baebf4b1dbc3e8/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 19:10:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=climc72izfarh5l2f4e4ymkhnfc4dxb737og77jrxlv7jmo3ypua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/12d0c17f48c94113f57a2f09cc31476945c1dc3fdfdc6ffd31baebf4b1dbc3e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 12d0c17f48c94113f57a2f09cc31476945c1dc3fdfdc6ffd31baebf4b1dbc3e8

(this sample)

AgentTesla

Executable exe 82ed346da97a3a9f64ca97ea2fbc0034d0a713e8c0003f0e982f28b85501ae47

  
Dropping
MD5 df5cdb6fe8052274c25dfc8bf1725eee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82ed346da97a3a9f64ca97ea2fbc0034d0a713e8c0003f0e982f28b85501ae47

Comments