MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e71ace3377073632d82dc1e6fc698d8f04521bac01cbf192284382eac3ec7c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e71ace3377073632d82dc1e6fc698d8f04521bac01cbf192284382eac3ec7c1
SHA3-384 hash: dac4acb67f31fe55a4eefd9122fcc6e460361e39c46e6db44fd690c3e228b526caecf1994173665f5e2923780ac95d42
SHA1 hash: e638d9767bbd1fa4b162922af7342b7799d1ff74
MD5 hash: 7330c872749c2f08810bfb6189e9e3f0
humanhash: coffee-mars-glucose-ceiling
File name:ENQ REF-1024500508.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'525 bytes
First seen:2020-05-28 11:43:43 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:MtRHf1levpMgwv3TjoowY/k4QG4KwqyiaF6iN:MfHfsMgwvTjok/kBG4iaIiN
TLSH C3842347476BB6C71247AF181FC99602ABE30132649B38E741394BB8BC3A2653B5E5D3
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.mynewchannel.com
Sending IP: 117.53.155.209
From: Mai Hu <wilsonoffice4@gmail.com>
Subject: ENQ REF-1024500508
Attachment: ENQ REF-1024500508.cab (contains "ENQ REF-1024500508.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 12:06:49 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 4e71ace3377073632d82dc1e6fc698d8f04521bac01cbf192284382eac3ec7c1

(this sample)

AgentTesla

Executable exe 2916a8925f2e0be07b5dea2fe5f8f7c4e935ed76c206f9cb5c645874e1228ffa

  
Dropping
MD5 234df3b9d9e0e9d21d69479e693583ae
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2916a8925f2e0be07b5dea2fe5f8f7c4e935ed76c206f9cb5c645874e1228ffa

Comments