MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf6332d28e1d17c93af108362bf15c0802892112d1ecece33f431052f3695765. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf6332d28e1d17c93af108362bf15c0802892112d1ecece33f431052f3695765
SHA3-384 hash: 23a8c9026ff589fbe2e1993c865b02403155520847d851f3c4f89c103dfeba4fd594b8354a13118e6045839361f082f9
SHA1 hash: 29bdae4e78286bc505255c89c0215ff499f87b55
MD5 hash: 9d4d0a9047500efa1448c57ebf6cb58b
humanhash: alabama-lithium-mike-music
File name:Refno07312020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'806 bytes
First seen:2020-08-04 16:36:29 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:QLVRIrrjga15/BBs3ZtPE0RZGnvZI/cMJ:QLVRO82VMjRmO/cMJ
TLSH F184235DC0855AC4E3398DF8DC99B9C91CDA97B45BC06833EE2C498B9E4C8DC9CE1726
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: metzerplas.com.ec
Sending IP: 185.222.57.165
From: metzerplas-ecuador@metzerplas.com.ec
Subject: Re: DEVOLUCIÓN DE PAGO TT (Ref No.08042020)
Attachment: Refno07312020.gz (contains "Refno07312020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf6332d28e1d17c93af108362bf15c0802892112d1ecece33f431052f3695765/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 16:11:18 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5rtfuuodul4soxrba3cx4k4babisiis2hwozyz7imiff43jk5sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cf6332d28e1d17c93af108362bf15c0802892112d1ecece33f431052f3695765

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz cf6332d28e1d17c93af108362bf15c0802892112d1ecece33f431052f3695765

(this sample)

AgentTesla

Executable exe 4db172a3add025bb44505c227dc6ed6fadd0ca3f47f41b46ae11b7865b481539

  
Dropping
MD5 0607a43a14f17160bcb03aeb0f653880
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4db172a3add025bb44505c227dc6ed6fadd0ca3f47f41b46ae11b7865b481539

Comments