MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 582bd853d2b154a9d93693b2ec0bc06c0e69f1810aa08c42e6ac73c9d855d11e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 582bd853d2b154a9d93693b2ec0bc06c0e69f1810aa08c42e6ac73c9d855d11e
SHA3-384 hash: 082ed73b49c4e2810dd5a122b3ec501afac22f9ed57fded98ccfecc542cae78f50944d949f67928bd3ab93bb592fe01e
SHA1 hash: 79b7e7c119f99e5ad268e22b4db7eb047bbf68f4
MD5 hash: 466572072a56012b53d6f22e829a7c0f
humanhash: iowa-maryland-kitten-potato
File name:BILL OF LADING-3547432.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'625 bytes
First seen:2020-05-11 08:28:35 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:NnhcnUk+BxzkLcukk5MiQFFbD1+rnhNVcpQoK37o6+U2Me/uZPNotBQ:NWUkExzkpPQDHcNjPt3F+UrzN
TLSH 689423E679BAF1530007142147829FEE39D0BF87E5A4C399D7A0D93D8EDB91B0942B61
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ciushi.com
Sending IP: 209.58.149.66
From: Monica<info@ciushi.com>
Subject: SHIPPING DOCUMENT
Attachment: BILL OF LADING-3547432.cab (contains "BILL OF LADING-3547432.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generickdz-7778470-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 01:19:00 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lav5qu6swfkktwjwsozoyc6anqhgt4mbbkqiyqxgvrz4twcv2epa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 582bd853d2b154a9d93693b2ec0bc06c0e69f1810aa08c42e6ac73c9d855d11e

(this sample)

AgentTesla

Executable exe 0c66da4c29f72e3b1f9bd5eb8f35542af9a724f7daa227a73774104bb985eff1

  
Dropping
MD5 5dfb66abf9f7eedceaa33c29c4ef4e4f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0c66da4c29f72e3b1f9bd5eb8f35542af9a724f7daa227a73774104bb985eff1

Comments