MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8935d58407e65e630a7fe7eb4d32c58182ec447794bc87273f309361b925de9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8935d58407e65e630a7fe7eb4d32c58182ec447794bc87273f309361b925de9a
SHA3-384 hash: 1af304f790d2d58a043c53a3c69b5b2d874a030876700bd76fe846494d489e57380697f70033471d82d64efc4493c83b
SHA1 hash: 7b293f9b66aee407374c11ff746022a4f9277e51
MD5 hash: 73b08c569fd6c9b1b8c9f11bcc9ea3a6
humanhash: delaware-fanta-stream-charlie
File name:2coloriseziiINQ 2.CAB
Download: download sample
Signature AgentTesla
Create hunting rule
File size:353'836 bytes
First seen:2020-05-06 09:50:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:IUPCqCW6POsSCisG2BTfBbpx355OfZ8TX9/op9SC8AwTroEP8NuOi8mtnvEiItzS:Hl6GNfsG2BDBbpV/Oqt/ofSCqT8Ewodh
TLSH 9D742356C71DAB65D6C89C539308EDF42E1FB223BAFF72212202C0618696147BF9D7C9
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sip1-210.nexcess.net
Sending IP: 209.126.18.174
From: Colori Sezzi <info@colorisezzi.it>
Reply-To: Jonah@briistol.com
Subject: New INQ 4600208912 SC#3227
Attachment: 2coloriseziiINQ 2.CAB (contains "2coloriseziiINQ (2).exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.16926.28025.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 10:36:48 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=re25lbah4zpggct747vu2mwfqgboyrdxss6iojz7gcjwdojf32na._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8935d58407e65e630a7fe7eb4d32c58182ec447794bc87273f309361b925de9a

(this sample)

AgentTesla

Executable exe 72102a41d1ba022e6d9a13dbb3492105bbfa8fc9707a311c81f7646653e9f11a

  
Dropping
MD5 6340c6c5695480d8ae6ca60172b2c23b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72102a41d1ba022e6d9a13dbb3492105bbfa8fc9707a311c81f7646653e9f11a

Comments