MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25d9a66dc2e65e73ec820439cb7402be16a21783e5b8cdcbc83241de088d4f11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25d9a66dc2e65e73ec820439cb7402be16a21783e5b8cdcbc83241de088d4f11
SHA3-384 hash: 70f3408f201d264b4607476e93d5e019c051846d1ba512466b2699ef5e6aa872cecbafd6798b49c52e687ef3daaa719f
SHA1 hash: 3c4f49ebefe946c36f4420cf9367bdb1a9fc64ad
MD5 hash: 71e5b8eb92d23958a76c7c52db971141
humanhash: emma-friend-lithium-sad
File name:inquiry.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:411'370 bytes
First seen:2020-08-06 05:50:54 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:F9tJV8kZtC1HM4wRP+cYEFJPqVAaqR1kORqse0/vA:FbJCkb45wRraqRNZvA
TLSH 819423E3BD1173EA8E4B95EB9B137781337856A3DA17F1EE924106CD858B543E44E00E
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: penascop.com
Sending IP: 95.211.208.41
From: benyapa Nattapong<jayusman@penascop.com>
Subject: URGENT INQUIRY
Attachment: inquiry.cab (contains "inquiry.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25d9a66dc2e65e73ec820439cb7402be16a21783e5b8cdcbc83241de088d4f11/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:01:47 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=exm2m3oc4zphh3ecaq44w5acxylkef4d4w4m3s6igja54cenj4iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/25d9a66dc2e65e73ec820439cb7402be16a21783e5b8cdcbc83241de088d4f11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 25d9a66dc2e65e73ec820439cb7402be16a21783e5b8cdcbc83241de088d4f11

(this sample)

AgentTesla

Executable exe 962c2cf22d64fd5c216006ac6ecc6bd0e7fa9fa24e8c471695dc84b25b985c7d

  
Dropping
MD5 545d6ca59a543d6cb84ee0e1049e7af3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 962c2cf22d64fd5c216006ac6ecc6bd0e7fa9fa24e8c471695dc84b25b985c7d

Comments