MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85447977c84c192b7c3fd6e03a3517ff5d938bfca313c1548d50d537f4dda52d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85447977c84c192b7c3fd6e03a3517ff5d938bfca313c1548d50d537f4dda52d
SHA3-384 hash: fc676260890819ad8e952a8b20b16b00e9ee64201e9f8ffaf3a8aa57fd7f23316ba754dccb46cb63bcf4a2a6542fd3b4
SHA1 hash: dde306cb7047ade7559c50c589008fe54d5408ae
MD5 hash: 416c66f4715705eee40c9caa77a834ea
humanhash: lima-montana-nineteen-north
File name:2020-08-12, PO 62520WS.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'323 bytes
First seen:2020-08-15 17:26:08 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:pQqyoUwXB7IF4/ft/jvALFYHkArOsz1VMHhN1pO3JAyIgO2/7R3CJCAl+ZsQ:VyoUwxQaZvALjyfGLnKeY5lEN+j
TLSH 9BD423298BDEAF93681EC00F61817D050DE2E250CE329FEC29B9DC81B15B45472BD6F9
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server01.adhiart.net.pe
Sending IP: 95.217.97.153
From: TECHVAL CONTROL <ventas@victim-domain.pe>
Subject: Solicitud de Cotización
Attachment: 2020-08-12, PO 62520WS.cab (contains "2020-08-12, PO 62520WS.exe")

AgentTesla SMTP exfil server:
web2.changeip.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.47874.13839.12691.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85447977c84c192b7c3fd6e03a3517ff5d938bfca313c1548d50d537f4dda52d/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 17:28:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvchs56ijqmsw7b723qdunix75ozhc74umj4cvenkdktp5g5uuwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85447977c84c192b7c3fd6e03a3517ff5d938bfca313c1548d50d537f4dda52d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 85447977c84c192b7c3fd6e03a3517ff5d938bfca313c1548d50d537f4dda52d

(this sample)

AgentTesla

Executable exe 58805ca0fd3a90e39f91288205ca09193ce3fc83424c44f85fdbbe9c1a14bb42

  
Dropping
MD5 8cd737c924f50c5c3310a032906bee76
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58805ca0fd3a90e39f91288205ca09193ce3fc83424c44f85fdbbe9c1a14bb42

Comments