MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc4cc3ab39b2bfc14696dd505e19accb3638e7da40834e0d137a649aa08d6a9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc4cc3ab39b2bfc14696dd505e19accb3638e7da40834e0d137a649aa08d6a9f
SHA3-384 hash: 359065bebfd9eae14ba91887c360793fca6d753d3975a850718f9f6ddb29423c1cadf6b407658d011c92b4c4808af69a
SHA1 hash: 019dab66ad316fcc924c7bcaf01c0a5b1fcf9a15
MD5 hash: acadccad5a019546fa04ff22bc8af0f7
humanhash: butter-louisiana-princess-freddie
File name:Payment Swift.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:438'085 bytes
First seen:2020-06-22 11:36:09 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:J4r8yb0GPjgO4RZAik4136lbeDecgeM02oLJ:JVjegNvAb44EgdWl
TLSH A89423C9EE39F7096A3C25F541088304DC61946B62B7BE36F2DD137065A02A7EB835AD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.viteltek.com
Sending IP: 104.237.144.27
From: Torres Rosa E <rtorres@nashvillewire.com>
Reply-To: Torres Rosa E <rtorres@nashvllewire.com>
Subject: Re: RETURN BACK PAYMENT TT (Ref 0180066743)
Attachment: Payment Swift.pdf.gz (contains "Payment Swift.pdf.exe")

AgentTesla SMTP exfil server:
mail.trademaxperu.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc4cc3ab39b2bfc14696dd505e19accb3638e7da40834e0d137a649aa08d6a9f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 11:38:04 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrgmhkzzwk74cruw3vif4gnmzm3drz62icbu4ditpjsjviennkpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz cc4cc3ab39b2bfc14696dd505e19accb3638e7da40834e0d137a649aa08d6a9f

(this sample)

AgentTesla

Executable exe 04a96c27fbf30289fd6b9960478848b6e350543eb6f65e178a9bc29e2e9bc984

  
Dropping
MD5 d3ea2f7cde996955a4254a558699efe3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04a96c27fbf30289fd6b9960478848b6e350543eb6f65e178a9bc29e2e9bc984

Comments