MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 500dd1dca55fe496890f2ece67c3a76b682edb01dbb3ce745a28f1dc9bf0cc82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 500dd1dca55fe496890f2ece67c3a76b682edb01dbb3ce745a28f1dc9bf0cc82
SHA3-384 hash: ae2f87c604077aab57b757d318e51260610608ed3047b2aa83ddc632b00c183ff7ba5ac65c738714e08044b6513500c4
SHA1 hash: 4e8989c250ebd0089cbe8f583d0712f71e51e32e
MD5 hash: eda5f6e12545e18ce635a6693fe714e0
humanhash: table-autumn-foxtrot-lion
File name:TT copy.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'298 bytes
First seen:2020-08-08 08:03:59 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:1ecQ9IoyEtysFpSEZnfrvZfGldeeQS0XtU:cIEosXSEdfrA+zU
TLSH 3B942346150CF91C1921E52EB221977092DEA36BF4018C1D2EB91D1AB89F089FE7F5BF
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: yargiforeigntrade.com
Sending IP: 95.211.208.41
From: "claere Rivera"<purchasing@yargiforeigntrade.com>
Subject: FW: Payment Receipt
Attachment: TT copy.cab (contains "TT copy.exe")

AgentTesla SMTP exfil server:
smtp.ociii.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/500dd1dca55fe496890f2ece67c3a76b682edb01dbb3ce745a28f1dc9bf0cc82/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 00:20:50 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kag5dxffl7sjncipf3hgpq5hnnuc5wyb3oz445c2fdy5zg7qzsba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/500dd1dca55fe496890f2ece67c3a76b682edb01dbb3ce745a28f1dc9bf0cc82

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 500dd1dca55fe496890f2ece67c3a76b682edb01dbb3ce745a28f1dc9bf0cc82

(this sample)

AgentTesla

Executable exe 8736ffe12cdc4791e4c340a1da9f52025faea789d2a6f75bda4e24e2a7ff5be8

  
Dropping
MD5 88b0042ee1c7aec435ab5540b1d52799
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8736ffe12cdc4791e4c340a1da9f52025faea789d2a6f75bda4e24e2a7ff5be8

Comments