MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd6b97dadde4cbc32c90dfd5d11a8326e00a752d626df2a995fc490ec20ae59e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd6b97dadde4cbc32c90dfd5d11a8326e00a752d626df2a995fc490ec20ae59e
SHA3-384 hash: fd6a71ba6fade59e4ce4f4c5544b2269ea338f0bd4d1da7cd4c2968b84b51c9009ef8485d923a429a1e03054e037ce73
SHA1 hash: 50b64fe4f1cb8d43436ce4b5eec40a4f5a8cf126
MD5 hash: 86363d49f8d0c04522d3b6c0363a8d06
humanhash: ten-table-undress-nitrogen
File name:New PO 0122122265534111323445 Documents.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'067'386 bytes
First seen:2020-06-02 07:27:36 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:ywu5ze9gfFKq2ZYhcUSCe0naqK8CIA7QpuR+sMKnxCnt1n:ywSze0FKql7bI8C4vqQL
TLSH 70353304A85E71083ED6F14409E7BB4CF66AD4D1C4BED1E05A2C87DFE9902AB18CC5BB
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pop.kenyaweb.com
Sending IP: 194.201.253.11
From: Miss Victoria <info@nocanar.it>
Subject: New Order
Attachment: New PO 0122122265534111323445 Documents.gz (contains "New PO 0122122265534111323445 Documents.exe")

AgentTesla FTP exfil server:
ftp.irregnancised.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 22:31:34 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvvzpww54tf4gleq37k5cgude3qau5jnmjw7fkmv7req5qqk4wpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz cd6b97dadde4cbc32c90dfd5d11a8326e00a752d626df2a995fc490ec20ae59e

(this sample)

AgentTesla

Executable exe 806f31221f182e4a97f68f267894aa671f18f5a8a112bf70ec1f64fd078b8000

  
Dropping
MD5 ee4835de0e935f701c758f9035784d3e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 806f31221f182e4a97f68f267894aa671f18f5a8a112bf70ec1f64fd078b8000

Comments