MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf6e3f0ce8b1a59ec6505147e394a273eb55f7c987faec8824001419ac4e807e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf6e3f0ce8b1a59ec6505147e394a273eb55f7c987faec8824001419ac4e807e
SHA3-384 hash: e46b836cfa0a479b7b42a4801c00f3ee0c45a55c1f9ecde2b49521c58c23dfeaee017aed51e37bec33b509d70d1bc912
SHA1 hash: fd7c05f6b2bf7ea4d4af855941edda80ed705f10
MD5 hash: 7fc89d78e0ab8903852e3bd1e97ca247
humanhash: virginia-chicken-network-double
File name:Inquiry.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'308 bytes
First seen:2020-05-19 06:23:48 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:OSWYOXg9te/2t8PJZ08oA4bY3KOX3osb12VbwgnTf:jWYOXH+8PJZ0jA0Y3KK12Zbr
TLSH D89423F2E9B336937964B7442B45D96EDDA34BF0260D2FA234171EA1C12996C843B7C3
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: wu.ac.kr
Sending IP: 203.246.100.70
From: Roberta C.G. Capelletti <chang@wkhc.ac.kr>
Reply-To: roberta@cgcapellatti.com
Subject: Trial Order
Attachment: Inquiry.GZ (contains "Inquiry.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 06:37:02 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5xd6dhiwgsz5rsqkfd6hffcopvvl56jq75ozcbeaakbtlcoqb7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz cf6e3f0ce8b1a59ec6505147e394a273eb55f7c987faec8824001419ac4e807e

(this sample)

AgentTesla

Executable exe ba123e2be2891c5decb58c5f87b722e363a86679d7823bc01f93cf58f1c8973a

  
Dropping
MD5 ed7359e4b434485f01549ef3ad72a85f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba123e2be2891c5decb58c5f87b722e363a86679d7823bc01f93cf58f1c8973a

Comments