MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eca3b72f45090a625ac980d786acdcd68ac7883ae0c9ed65e0d7a3ff960ee37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5eca3b72f45090a625ac980d786acdcd68ac7883ae0c9ed65e0d7a3ff960ee37
SHA3-384 hash: 4de1d5b8d6cf9ae596dc82d2d40f514d686bb325d2bf9111364561f7a4bb5877f33aa3188401a54278f8c171943d3f9d
SHA1 hash: 1bf85676c93e26080cbb479963ec7b72cf9f43ae
MD5 hash: db05fafa41d3fdf6e57950c347321f19
humanhash: freddie-autumn-stream-green
File name:Bridge Construction project Requirement BCPUAE.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'849 bytes
First seen:2020-05-11 08:18:42 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:wep3ecufK5MnT7eqr8AJlqE6dejOyW3HuXiCDN3ewcnPw9kf+jmRV0A9cqK:/8K5MnXhoAPqEPy3uSSN3ewaPiSRqA9A
TLSH 879423BF08B88AA5E4EAB8A62B446C7560D413C6D9B98D1FD410D1B7F0FE92C051D877
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mcicontainers.com
Sending IP: 209.58.149.66
From: Contractor Elena <gerard.grinwis@mcicontainers.com>
Subject: Reminder !!!! Construction project Requirement BCP_UAE
Attachment: Bridge Construction project Requirement BCPUAE.cab (contains "Bridge Construction project Requirement BCPUAE.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generickdz-7778470-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:42 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3fdw4xukcikmjnmtagxq2wnzvuky6edvygj5vs6bv5d76la5y3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 5eca3b72f45090a625ac980d786acdcd68ac7883ae0c9ed65e0d7a3ff960ee37

(this sample)

AgentTesla

Executable exe 0e32a299fee29afdd69c1fbc11b121ac6110650232dcbb28e6b8587f34395e42

  
Dropping
MD5 acc8b99d0d1992c1c469cf448cfaf1b3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e32a299fee29afdd69c1fbc11b121ac6110650232dcbb28e6b8587f34395e42

Comments