MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cebd6f31c22ae4a4572dbe43f7198309bf96e1a97124501ea93f1da61b4746f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cebd6f31c22ae4a4572dbe43f7198309bf96e1a97124501ea93f1da61b4746f2
SHA3-384 hash: 91c320dab1e8fd7236f4c4ca01775765e5ffc7d5c74f84b73c91af3811759002411fe4d2fa396d122ab1dfe9a732bbb2
SHA1 hash: 1382799183a32fe8c33d6727ada9a073e5689f61
MD5 hash: a3a2556bc89f523cb0091a09783fca6e
humanhash: maryland-twenty-lion-sierra
File name:contract invoice.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'525 bytes
First seen:2020-07-09 08:15:37 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:tlFHHFpg82TDf4JkNBs7k8Lg6v/ncbVQFNCJwi:t7HlpEHf4JkNBs7k8Lg6XntFNCd
TLSH EBB423F6B1C74D9C4E138738532E1E1D1466CC6067899F2F4A8F5B5128608D2A27EFBD
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corrpltd.com
Sending IP: 37.49.230.212
From: "Lucy Anderson" <seancunnings@corrpltd.com>
Subject: Signed Contract Invoice
Attachment: contract invoice.Z (contains "contract invoice.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cebd6f31c22ae4a4572dbe43f7198309bf96e1a97124501ea93f1da61b4746f2/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 08:17:03 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z26w6mocflskivznxzb7ogmdbg7znynjoesfahvjh4o2mg2hi3za._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z cebd6f31c22ae4a4572dbe43f7198309bf96e1a97124501ea93f1da61b4746f2

(this sample)

AgentTesla

Executable exe f93dab0fecce9ee199b9a5196b2c2b513b988b78d2f2d79b233e7a74c50176d7

  
Dropping
MD5 4c114fb1e6bc5985c208bb85906c28e4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f93dab0fecce9ee199b9a5196b2c2b513b988b78d2f2d79b233e7a74c50176d7

Comments