MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0fbb5689cb25c66b507e3c7863ac342e8b1e99dd6587a63aac3461bd08d0b87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0fbb5689cb25c66b507e3c7863ac342e8b1e99dd6587a63aac3461bd08d0b87
SHA3-384 hash: cd1c648f69c6fb3e3fa378ecaaf6c9a66743ac385ff6a84a663a7eec9873304a9d40ffb42a36dcbbe9b1692913de2664
SHA1 hash: 4059ddad79ad7f41c39eae981636da4c2ee79999
MD5 hash: d9ce7a3114efc8fe70c4be086f8a1930
humanhash: west-papa-robert-uncle
File name:RFQ#1021.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-11 13:49:04 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:I+NOvkOj643o28R6cnJj1td5S3mDYWZ0fLwEsdkmP1mNXW:f8cOj643o2KnVPjGmDYWyfNZ81mNX
TLSH 2B45CF1C57AC2557E92EC2FDC6C0840C63E9CD775655EB99BC8A31E41B3B397E80228B
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv2.trendstudio.it
Sending IP: 62.116.182.204
From: Angelina <info@lacatrade.com>
Subject: Nueva orden de compra RFQ#1021-Urgente
Attachment: RFQ#1021.IMG (contains "RFQ#1021-11062020.scr")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis8E8E7925A19E.17850.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 13:52:24 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yd53k2e4wjognnih4pdymowdiluld2m52zmhuy5kyndbxuenbodq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c0fbb5689cb25c66b507e3c7863ac342e8b1e99dd6587a63aac3461bd08d0b87

(this sample)

AgentTesla

Executable exe 4837818e08ee30bf269de7aea2a96c3bf5ad97dcac42a9b119011e2d9a744115

  
Dropping
MD5 8e8e7925a19e8e8e584fe8080bb03265
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4837818e08ee30bf269de7aea2a96c3bf5ad97dcac42a9b119011e2d9a744115

Comments