MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93cd5653cfd950a8e3c584692af1982b435e0014397a8f78b38dabb30fa4b9a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93cd5653cfd950a8e3c584692af1982b435e0014397a8f78b38dabb30fa4b9a4
SHA3-384 hash: 1d04c3b2d2ac99ea2388bf756377c9777fc2599d1a170af0bf3aaf022b3cbcbcaa1c2187e5783f410870f39fa83fc470
SHA1 hash: 5cbad5325c2ac87d30288736be4b86f027796f38
MD5 hash: fad51bf7c5555027e205be4a381f906a
humanhash: quebec-oklahoma-rugby-mockingbird
File name:1015676-ADMIN_200802010045_jobrpt_ZNA-CUSSTA_ADMIN_23454.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:623'109 bytes
First seen:2020-08-04 07:10:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ODcRB4G8cy+6bLMK6pDRAArT72r7E1SKBQ0M2VqHju12FyVBd9G8BVDlQ:OD6BqcyBN6XPTirIsKBjM20Hjg0ybfGT
TLSH 0AD423DF4ACE724DF95D78990D4DAEA7C3098B38B3480F2D645DC9E82604CA2761C36B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps-1503727-x.dattaweb.com
Sending IP: 66.97.33.103
From: Jose Luis Carbacho Tamayo <lifaic@symetra.com>
Subject: Statement Transaction Number
Attachment: 1015676-ADMIN_200802010045_jobrpt_ZNA-CUSSTA_ADMIN_23454.rar (contains "1015676-ADMIN_200802010045_jobrpt_ZNA-CUSSTA_ADMIN_23454!.exe")

AgentTesla SMTP exfil server:
mail.mexicanproduct.com.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93cd5653cfd950a8e3c584692af1982b435e0014397a8f78b38dabb30fa4b9a4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 04:51:07 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=spgvmu6p3fikry6fqrusv4myfnbv4aauhf5i66ftrwv3gd5exgsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/93cd5653cfd950a8e3c584692af1982b435e0014397a8f78b38dabb30fa4b9a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 93cd5653cfd950a8e3c584692af1982b435e0014397a8f78b38dabb30fa4b9a4

(this sample)

AgentTesla

Executable exe 6cfb8c7d072efbdeeb16075cc368dfee38cc4924595bb63027a97ea557d3b866

  
Dropping
MD5 d4ed287051e1a59d8b524a8f6c0c34bf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6cfb8c7d072efbdeeb16075cc368dfee38cc4924595bb63027a97ea557d3b866

Comments