MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfa8500855ccaa76851c94889a2180a28813d29e72d61555cec074461b0c1968. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfa8500855ccaa76851c94889a2180a28813d29e72d61555cec074461b0c1968
SHA3-384 hash: 9f15bc0587d85b722ed4562ba413b518ba637dc3215bd4f65de481162d9f2f684b5c8320b4e7a0e4b7e78e9de51f9279
SHA1 hash: eb4dcf195d08e8ad7ad4fa0fdf0f25bbd1401ce8
MD5 hash: fbed1745df0812f9720ee36bf11fe4a5
humanhash: lion-burger-diet-harry
File name:0909R0909000990.CAB
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'915 bytes
First seen:2020-05-28 13:54:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:TNEPWECKy+2SH0x6eSXg+LUIxbpsl9pZon2z/H7mOtvnVHDLpbzeg991DYysHLLk:BEPWcyqgvSJLFTsjpZon2DZPbcJc
TLSH 669423E1A2B4B7C00A600E57477EEAB3E77D19672739318A55C0E2E474B8F1CB187398
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lomaquilotodo.com.mx
Sending IP: 185.234.216.161
From: finanzas@lomaquilotodo.com.mx
Subject: Notificación de cuenta
Attachment: 0909R0909000990.CAB (contains "0909R0909000990.exe")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.1469.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 14:36:16 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cfa8500855ccaa76851c94889a2180a28813d29e72d61555cec074461b0c1968

(this sample)

AgentTesla

Executable exe 4dc1a8739a91b1de60bd63bf9d9f0a8c4619133ceb0c22e6559cdceecaf69086

  
Dropping
MD5 ea763cb9026f15c3f7406d91221488ff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4dc1a8739a91b1de60bd63bf9d9f0a8c4619133ceb0c22e6559cdceecaf69086

Comments