MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce15cdb78dfa14afe1928f6649a1e842ad69dc2d7284d687ff3afbfbca1a14a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce15cdb78dfa14afe1928f6649a1e842ad69dc2d7284d687ff3afbfbca1a14a1
SHA3-384 hash: 9127de73e3448dcae24751ff88f7bcb808fe27cb7bac7a584e49ae5d9e956558b95ae79eb62e215c6cff57d0c2ad875f
SHA1 hash: 6ed270a8d2b8be8da99e0affbb289cde344ed927
MD5 hash: 1736b2e7ece2a95a91a74d0d0124f237
humanhash: july-table-montana-nuts
File name:EXW-INV_59253725FT.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'676 bytes
First seen:2020-07-30 07:24:32 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:zPkZ2O/SLqDy23TbD34Q67MQyZPXd3ABBtlX:Lkx/wqDyED34Q67MXRAj7
TLSH 04942362A9C8301B6B5577218FA1B730C6C8FFF6DAB581933296EC6E354E1FB11D0512
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-505127.us-midwest-1.nxcli.net
Sending IP: 104.207.254.173
From: ROYAL CARGO <tuan.nguyen@royalcargo.com>
Subject: Thông báo gửi hàng cho EXW-INV_59253725FT
Attachment: EXW-INV_59253725FT.r00 (contains "EXW-INV_59253725FT.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce15cdb78dfa14afe1928f6649a1e842ad69dc2d7284d687ff3afbfbca1a14a1/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 07:26:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyk43n4n7ikk7ymsr5tetipiikwwtxbnokcnnb77hl57xsq2csqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce15cdb78dfa14afe1928f6649a1e842ad69dc2d7284d687ff3afbfbca1a14a1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 ce15cdb78dfa14afe1928f6649a1e842ad69dc2d7284d687ff3afbfbca1a14a1

(this sample)

AgentTesla

Executable exe 8363ee54cb3c903724763dae8520da1a7234dcf60463a72ed7cc44494c01dc5a

  
Dropping
MD5 d7b36e6ab0d2aa53429d3fc94e3e08cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8363ee54cb3c903724763dae8520da1a7234dcf60463a72ed7cc44494c01dc5a

Comments