MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85e132def4d7cc1819763c85583301836d88f215e3c9aa63111ef6872849f8b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85e132def4d7cc1819763c85583301836d88f215e3c9aa63111ef6872849f8b6
SHA3-384 hash: bfda17622a3139bedb4e5148666f48977fc848159a7662b597d31e7a5e7a46ff43b25b1f63b5d64ddc54c390eae671b4
SHA1 hash: 27ef4dd6718e3478a3762c6c1f3137d8896afb07
MD5 hash: 65fed95b16e1a3557694e750d66dd582
humanhash: magazine-enemy-triple-fruit
File name:ODEN DE COMPRA.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'795 bytes
First seen:2020-08-19 13:06:34 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:LayoAs+dpSm2R1v1glC/uSL140X+3jh1HFT:doyw1R1vKlC/HS0X+3Hh
TLSH 96A423F45114869A70867C8221082573F25A8F123FE07F76BB23B7DAFDB0DAE0B21546
Reporter abuse_ch
Tags:AgentTesla cab Hostwinds


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-762381.hostwindsdns.com
Sending IP: 104.168.219.245
From: Diego Alonso Ramos <info@ascenduum.pw>
Subject: Re: orden de compra
Attachment: ODEN DE COMPRA.cab (contains "ODEN DE COMPRA.exe")

AgentTesla SMTP exfil server:
web2.changeip.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.18095.14852.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85e132def4d7cc1819763c85583301836d88f215e3c9aa63111ef6872849f8b6/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 13:07:14 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxqtfxxu27gbqglwhscvqmybqnwyr4qv4pe2uyyrd33iokcj7c3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85e132def4d7cc1819763c85583301836d88f215e3c9aa63111ef6872849f8b6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 85e132def4d7cc1819763c85583301836d88f215e3c9aa63111ef6872849f8b6

(this sample)

AgentTesla

Executable exe 905b81f5f4dff67d723fb98f5a54ea1fe1786a1c971fcf455f6ef0cc2d7e2383

  
Dropping
MD5 fcb884ddfb89dc09bcf53afcee3dd107
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 905b81f5f4dff67d723fb98f5a54ea1fe1786a1c971fcf455f6ef0cc2d7e2383

Comments