MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92abde965e8f447d90a5dae9b2859279bbf068fbfca38606543962f5a243ec49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92abde965e8f447d90a5dae9b2859279bbf068fbfca38606543962f5a243ec49
SHA3-384 hash: f4b37c79573f39c4b4befc72f56792b7ec417422e174298b1ed2a79462328df42c14ab66ca5a03b7326a9c22d4e224ae
SHA1 hash: 9105057aa8d31087bf5cbe5f39a79baa63e3ee46
MD5 hash: a50337730889dba2a8f8775bcb925761
humanhash: network-ten-april-sad
File name:orden de compra.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:598'400 bytes
First seen:2020-08-12 14:33:01 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:WAE+s/cOzmPh6VRr8KKINliMIlnHTbTWG8CrDwlH5GgqMWSBjtC:9E+aoP438BINliMIZbTWtCr0BmEBxC
TLSH 4ED423C9B125295BBD006773D80A78B17113C708815CA794E4EAF76AFFE16AC1EE60D3
Reporter abuse_ch
Tags:AgentTesla cab Hostwinds


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-762381.hostwindsdns.com
Sending IP: 104.168.219.245
From: Diego Alonso Ramos <info@ascenduum.pw>
Subject: Re: orden de compra
Attachment: orden de compra.cab (contains "orden de compra.exe")

AgentTesla SMTP exfil server:
web2.changeip.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92abde965e8f447d90a5dae9b2859279bbf068fbfca38606543962f5a243ec49/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 14:34:10 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=skv55fs6r5ch3eff3lu3fbmspg57a2h37srymbsuhfrplisd5req._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92abde965e8f447d90a5dae9b2859279bbf068fbfca38606543962f5a243ec49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 92abde965e8f447d90a5dae9b2859279bbf068fbfca38606543962f5a243ec49

(this sample)

AgentTesla

Executable exe 6c3bf021d2c48ff27cfeab73b69e09f5137945707ad8bdefbbcf97df508499f9

  
Dropping
MD5 a8554dd23f8bc62f3e62c721e7b87579
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c3bf021d2c48ff27cfeab73b69e09f5137945707ad8bdefbbcf97df508499f9

Comments