MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c97caedeee7ac38c6fede4e62f5355b8d6c1a3b6e3c60a78d2a8b727f8a83449. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c97caedeee7ac38c6fede4e62f5355b8d6c1a3b6e3c60a78d2a8b727f8a83449
SHA3-384 hash: 074329f4340ed5562a99c04b551a5e8ee11202c50c376d83a8fb5c8792852cb8a5d4788f1383e108e379cdbe2a0090c9
SHA1 hash: ae292f8d04e7f64dfee6339c79b325b5075c0b4f
MD5 hash: e35cd9564e258a3568c32079736ce457
humanhash: california-bakerloo-golf-sink
File name:Solicitud de cotizacioÌ n.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'225 bytes
First seen:2020-08-14 15:06:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ujsyaUTWnrhVcDXMguByuDqBiCljDhrNG1E:uQqChVoXtuMuDqTj1ZSE
TLSH 06842300444F1A0970B97EB7D5E58D1D4ACAA7E736A36718D0822D02D99E4738BF86FE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps-211341.montevideo.net.uy
Sending IP: 190.64.204.72
From: Mauricio Munoz Barros <vipechi@gmail.com>
Subject: Solicitud de cotización.
Attachment: Solicitud de cotizacioÌ n.zip (contains "Solicitud de cotizacioÌ n.exe")

AgentTesla SMTP exfil server:
smtp.pharco--corp.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.c8dec8b3699f5ab9.10342.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c97caedeee7ac38c6fede4e62f5355b8d6c1a3b6e3c60a78d2a8b727f8a83449/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 15:08:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zf6k5xxoplbyy37n4ttc6u2vxdlmdi5w4pdau6gsvc3sp6figreq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/c97caedeee7ac38c6fede4e62f5355b8d6c1a3b6e3c60a78d2a8b727f8a83449

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c97caedeee7ac38c6fede4e62f5355b8d6c1a3b6e3c60a78d2a8b727f8a83449

(this sample)

AgentTesla

Executable exe af2c5c77ba52532806daae8bffadb2c5a4073009e0f485302d2c816ff315a8a7

  
Dropping
MD5 c8dec8b3699f5ab9046e8da48d15d171
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af2c5c77ba52532806daae8bffadb2c5a4073009e0f485302d2c816ff315a8a7

Comments