MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfa7f05133b81360e24875fb933f29fb5811736e9b86cf356248b56fecce128c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfa7f05133b81360e24875fb933f29fb5811736e9b86cf356248b56fecce128c
SHA3-384 hash: 3affb9195854a819e9757baa4fca84196841fbfb3b39367b7e4d31ced2b425594436aaa91cd0284bc446d1c0481e1416
SHA1 hash: 3b67a250188a167810236485aaa815ba91a25146
MD5 hash: 90aed3e0ddbc381e7c414a3decabe4bc
humanhash: delaware-harry-princess-four
File name:Quotation Valves flanges and fittings.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'360 bytes
First seen:2020-05-13 06:07:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3uqxO7cx2Flcs8bN7vQ/VJLTafu3dDFDPRc:EpFus8B7Aafu3dDFa
TLSH 1284235716EB6C0E3250C9D38CA8D3BC2295FE4C0C1D7C4315596D87A8B7AE31D4BAE9
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: formin <formin@formin.com.cn>
Subject: Quotation Valves & flanges and fittings
Attachment: Quotation Valves flanges and fittings.rar (contains "Quotation Valves & flanges and fittings.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 13:55:51 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6t7aujtxajwbysiox5zgpzj7nmbc43otodm6nlcjc2w73gockga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cfa7f05133b81360e24875fb933f29fb5811736e9b86cf356248b56fecce128c

(this sample)

AgentTesla

Executable exe 2919867ab52378d55e7d91b3b18c30b79c8527621aa9e2c2fe71d0b89dbc404a

  
Dropping
MD5 bc31e6b8c5414b43748f2a75ffe32724
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2919867ab52378d55e7d91b3b18c30b79c8527621aa9e2c2fe71d0b89dbc404a

Comments