MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 834f95cd7789148cce1933972a3ea30199c184e172c35709a3440dbed8774bc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 834f95cd7789148cce1933972a3ea30199c184e172c35709a3440dbed8774bc0
SHA3-384 hash: df331a8d819d05975690a712343dfc2e95d4cedeee572c6a7fddaafc10453edcf1dfe30306cd35a71ef205d3f7fa0ff1
SHA1 hash: 06421f3a83ac9434faab853f5ac21fc442c85463
MD5 hash: a45f24eaa1cbb04f2b0e6dcd7805b8c8
humanhash: west-sierra-spring-kentucky
File name:RFQ _PDF.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:560'151 bytes
First seen:2020-05-04 17:12:18 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:VuvxspKCsO5v1qVvxgha86t/2NZukO6OTH5r/YOa2n/squKc5FSgI:VuwTqVJN12/Mqy/sQmo
TLSH 4BC42360B18E18FB573C417EA42EB8646C8D37E4C7128071BA8231926B537594BFBEDD
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.safemail.it
Sending IP: 147.123.1.124
From: David Antal<monish@optimacapitol.ae>
Reply-To: fasail.fmfashion@gmail.com
Subject: RFQ #201901959
Attachment: RFQ _PDF.cab (contains "RFQ _PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48312.32674.1009.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 09:36:46 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qnhzltlxrekiztqzgolsupvdagm4dbhbolbvocndiqg35wdxjpaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 834f95cd7789148cce1933972a3ea30199c184e172c35709a3440dbed8774bc0

(this sample)

AgentTesla

Executable exe e67f30ee8be83b021b5ba3ebe65e610fc1a50ce3f3cb1c081f62ada165d84186

  
Dropping
MD5 581b78ab46d2f36327b980facc8bd763
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e67f30ee8be83b021b5ba3ebe65e610fc1a50ce3f3cb1c081f62ada165d84186

Comments