MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e3051954be47bea2994363594535311d5e8d32be059e45a16dc0a6e96dce262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e3051954be47bea2994363594535311d5e8d32be059e45a16dc0a6e96dce262
SHA3-384 hash: a787dd5af1cde1907f7a8f6ecec55e1a4ce489e52de99e06e4db79e24ce09ea54942957011fd0f5200574ed44ed61aad
SHA1 hash: cd98fc9420589ea0ec2ad2006249697d42be49f1
MD5 hash: bb09239eb763397ea04c73e9de203d96
humanhash: steak-eight-seven-indigo
File name:Sample Photos.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:258'370 bytes
First seen:2020-08-06 05:18:32 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:ZOOuWnj77rKsxZiZaBNanYnTfEDaVZfaKKhAzG:Y+j77rKgeaBNansbAaPUAzG
TLSH FB44235342E01F9C92CD813D74CA6B41A0DEEE46560BFDE6E9D3786D907E0C8F62C58A
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Ulf Hellmuth <raksha_s@kellyservices.co.in>
Reply-To: Ulf Hellmuth <fasail.fmfashion@gmail.com>
Subject: NEW ORDER & Sample Photos
Attachment: Sample Photos.cab (contains "Sample Photos.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.12744.18985.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e3051954be47bea2994363594535311d5e8d32be059e45a16dc0a6e96dce262/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:20:06 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dyyfdfkl4r56ukmugy2ziu2tchk6ruzl4bm6iwqw3qfg5fw44jra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/1e3051954be47bea2994363594535311d5e8d32be059e45a16dc0a6e96dce262

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 1e3051954be47bea2994363594535311d5e8d32be059e45a16dc0a6e96dce262

(this sample)

AgentTesla

Executable exe bf409bd3dccf3005993cd4904c04536009b0426b0b6cd087930d56ce5f7390c1

  
Dropping
MD5 3b0348f2ee2b5a7ae9fdefa9d7a34892
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bf409bd3dccf3005993cd4904c04536009b0426b0b6cd087930d56ce5f7390c1

Comments