MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4819a13c30fab7b5dfa3b4918bf21ffd8a9dda2d53155f0a16c30cad0899679b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4819a13c30fab7b5dfa3b4918bf21ffd8a9dda2d53155f0a16c30cad0899679b
SHA3-384 hash: 6f9d07961fef36997ac9ffac3e2b0ae599e050248dad951be0f8fde7fdbf9a349abe328fcb6f1bf2f64a0a708065dc97
SHA1 hash: 39ee6148f863f22ce60ac72a3afeb9a2a1043a81
MD5 hash: 3fe4ff2690a06b929054576f296b9993
humanhash: alpha-seven-whiskey-bluebird
File name:Speceification.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'035 bytes
First seen:2020-06-04 07:21:40 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:DCm/NEJqzOfqYRHpNjwvqDQs5mU7RMqY7r+W+fqUYFQru5Qc59A6s0wBL2:DH/NEHf7ZNXRk7KXyUpc5fI52
TLSH 0A8423FDF8B6EA2A900CF58DD4EC8D080605C5BA675DE57AEBBCF0451D060E6AD7C212
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: asko119.com
Sending IP: 209.58.149.66
From: Roney Root <smedi@asko119.com>,
Subject: Quote
Attachment: Speceification.cab (contains "Speceification.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 07:37:14 UTC
AV detection:
12 of 31 (38.71%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jam2cpbq7k33lx5dwsiyx4q77wfj3wrnkmkv6cqwymgk2cezm6nq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 4819a13c30fab7b5dfa3b4918bf21ffd8a9dda2d53155f0a16c30cad0899679b

(this sample)

AgentTesla

Executable exe 08f2608e738af40f8ba5a8d34435c988fad03aa07bad9d068379a3134ceaf42e

  
Dropping
MD5 11c38eae8280deaf5b5e79955869c5e3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08f2608e738af40f8ba5a8d34435c988fad03aa07bad9d068379a3134ceaf42e

Comments