MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c190cc89f34228773682ef5d7f98d1787b6c2ba36a73e953f8eb033d5443277d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c190cc89f34228773682ef5d7f98d1787b6c2ba36a73e953f8eb033d5443277d
SHA3-384 hash: b8a342786166ec5d5d9e5705e3f6be69d0e524ec6ead6413760cd926ab584ac33970ff66eb6e5b0179095c38cf4ecf89
SHA1 hash: 8e92d0084fba976911b441258d28c6235fc54a1e
MD5 hash: 85bd34fecc710107a8c6316511e24c3c
humanhash: wyoming-fix-eighteen-hydrogen
File name:20200629.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:628'612 bytes
First seen:2020-07-20 08:23:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:nDqlUgkWMBgAAYro/70uq7dj3MDWttnWD5TN/D/P795ftvB6TeT9:DM8eAA4cq98Wttm5TdD3BPp
TLSH A3D423185CEE39B25C8A326E01629C632EBE94D86F36ED2D7DA0D2539047CF4135ED98
Reporter abuse_ch
Tags:AgentTesla Endurance rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: Summer Xu <mariobelluno@libero.it>
Subject: RE: 2020 07 21 new order20200629
Attachment: 20200629.rar (contains "20200629.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c190cc89f34228773682ef5d7f98d1787b6c2ba36a73e953f8eb033d5443277d/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:25:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygimzcptiiuhonuc55ox7ggrpb5wyk5dnjz6su7y5mbt2vcde56q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/c190cc89f34228773682ef5d7f98d1787b6c2ba36a73e953f8eb033d5443277d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c190cc89f34228773682ef5d7f98d1787b6c2ba36a73e953f8eb033d5443277d

(this sample)

AgentTesla

Executable exe 75bbc70571b6ac43e86fabd0e79f1320c2ebdd9cb5da8eb89c6007d27edcd0cd

  
Dropping
MD5 b5290974c074224f9db049a39e72b182
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75bbc70571b6ac43e86fabd0e79f1320c2ebdd9cb5da8eb89c6007d27edcd0cd

Comments