MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7286ef8488ec32dc085ae927a4c0b7c5f1e3f83a75a189e3dbe1bd7e2ed5512e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7286ef8488ec32dc085ae927a4c0b7c5f1e3f83a75a189e3dbe1bd7e2ed5512e
SHA3-384 hash: d7cb33a7054fc310dde3595faf6865d37e1c9050c5812b5a007f986062e1dc9c17d8923047dc9c51662b97f0fd28664e
SHA1 hash: 295860f21c4d25e977d11a3e68236cbb18de6036
MD5 hash: 377000993e5a850c394b8711a611bdd1
humanhash: beryllium-mike-jupiter-louisiana
File name:OC_Y091648273.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:517'444 bytes
First seen:2020-05-21 10:41:19 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:C4d0y496TcIdUBxh+BdyYGbgDVFglH8VtJmA:FF48cIdUfh+BRGbgDVFglH8VL5
TLSH D4B42336F680FF14B1DD19BAA67921919CC30197D972D4FAC7263AF1583C4DA8BE284C
Reporter abuse_ch
Tags:AgentTesla cab HostGator


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway22.websitewelcome.com
Sending IP: 192.185.47.144
From: Julia Gutierrez <elena.fernandez@arequipatrack.com>
Subject: RE: ORDEN DE COMPRA
Attachment: OC_Y091648273.cab (contains "OC_Y091648273.exe")

AgentTesla SMTP exfil server:
smtp.megoagro.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.17.6842.21950.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 11:36:58 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 7286ef8488ec32dc085ae927a4c0b7c5f1e3f83a75a189e3dbe1bd7e2ed5512e

(this sample)

AgentTesla

Executable exe 348ab69ec7c99d1803d0b8b29f5959fff8dd6daed1d992f7da2d796495ac0a67

  
Dropping
MD5 38200f27bf7337dc20db1fe24f8eaf85
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 348ab69ec7c99d1803d0b8b29f5959fff8dd6daed1d992f7da2d796495ac0a67

Comments