MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd40c7fde24d189a763cd1752acd99ecac9bb25bd3c4c3cccd031fdf69f73647. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd40c7fde24d189a763cd1752acd99ecac9bb25bd3c4c3cccd031fdf69f73647
SHA3-384 hash: ea6cf6e68705375b81caa811adbd1a3d4721b531d40f81361fd484f7fbdb171134757b8999841addddce5360fcd4effb
SHA1 hash: 06687db9746ec23fae06f2c93696cbf9c3db5c0d
MD5 hash: 6eb578245647acd1b3e0a3b7bb1c80b5
humanhash: nevada-london-single-triple
File name:Mediform SA Order 13082020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'762 bytes
First seen:2020-08-13 11:46:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:qAdD1+ejlZhe/flDcTfnYvyh7dvjJgVoekUst3gSlgahGE:fjfM/fVcDtRy2tZgagE
TLSH 6FA423B5FA772060336E11272C86828BCF2C859BB435F455AC28766670F3749DE334A9
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hshgroups.co
Sending IP: 104.168.166.26
From: Mediform S.A<mediform.s.a@hotmail.com>
Subject: Re:Fw: Request For New Inquiry RFQ
Attachment: Mediform SA Order 13082020.rar (contains "Mediform SA Order 13082020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd40c7fde24d189a763cd1752acd99ecac9bb25bd3c4c3cccd031fdf69f73647/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 11:48:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvamp7pcjumju5r42f2svtmz5swjxms32pcmhtgnamp562pxgzdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd40c7fde24d189a763cd1752acd99ecac9bb25bd3c4c3cccd031fdf69f73647

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cd40c7fde24d189a763cd1752acd99ecac9bb25bd3c4c3cccd031fdf69f73647

(this sample)

AgentTesla

Executable exe f08055b66d4e8209560d1322c12c553b466ec737196e597ae00694e8035c25d2

  
Dropping
MD5 cf6ade4a216c4daae539075da6311090
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f08055b66d4e8209560d1322c12c553b466ec737196e597ae00694e8035c25d2

Comments