MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf4e9aab51faf6ba3de9470dc1d8d9b8fdcd63ac16c2cb95acb422bb16a480db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf4e9aab51faf6ba3de9470dc1d8d9b8fdcd63ac16c2cb95acb422bb16a480db
SHA3-384 hash: 4122913e11b2087d895c316f87439889a5362d27c4e2b66ba0f78650d34d5105f4ac74756a1bc47baca5ff1249bcbd40
SHA1 hash: a7d70fc4f54fbd55852f5634208f57cac00998bc
MD5 hash: 581233f16cc396557aa1d3d13224c883
humanhash: grey-undress-lake-item
File name:Factura Abril.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'604 bytes
First seen:2020-05-11 14:27:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:y01/E4IiAAM4/4xRsaD+sN87d2GePq1Dd+X:y8E4IPAx4kTsN8iSHA
TLSH 29842391DDD14C291F62EC5EB3E58F166B42AF743DE7356A406A3DD8AC389F0012F21A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1.tiservinet.net
Sending IP: 178.33.68.12
From: Francisco J Navaro <infomacion@mtt-maxim.com>
Subject: Factura Abril
Attachment: Factura Abril.rar (contains "Factura Abril.exe")

AgentTesla SMTP exfil server:
mail.tarzmobilya.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:37:33 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5hjvk2r7l3luppji4g4dwgzxd642y5mc3bmxfnmwqrlwfveqdnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cf4e9aab51faf6ba3de9470dc1d8d9b8fdcd63ac16c2cb95acb422bb16a480db

(this sample)

AgentTesla

Executable exe ee7e73942f7e98f086e9abe234870e07bdd2dc36808c26b8c84f434e2c4fa4c1

  
Dropping
MD5 c797d159e47dfbd7a39f6cf22d133604
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee7e73942f7e98f086e9abe234870e07bdd2dc36808c26b8c84f434e2c4fa4c1

Comments