MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cff1cc3b02bf7d699b880ec9dbd3f4bdddb607cc0e84c956178d00f428fe86af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cff1cc3b02bf7d699b880ec9dbd3f4bdddb607cc0e84c956178d00f428fe86af
SHA3-384 hash: 57a0e1f01483727421d175d85a9f950f5a3a5254c58887bd00c97be9fee33cba570699c026fae67cfd2a777c6834d00f
SHA1 hash: 244fe5136c103f0a5e2515b4c634f1b0518cbb36
MD5 hash: bb7d52d6c8bde8b296520e4f9fe0796e
humanhash: hydrogen-muppet-quebec-monkey
File name:PO_2002837727_288772.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:555'868 bytes
First seen:2020-08-12 18:21:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PpZAX4PREFWZ/6Lh/7c8HSmoDPfNxvV+j+NoblB9:PpZAX4PR0Wd61/7cLfNxvV+p5v
TLSH 63C423021A077D7332CA7612D9E45EBBA3B05443E4B1651AC63F9F29748CEEC3E985C1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.huclangia.ga
Sending IP: 5.8.93.140
From: Elvis Tiñini <report@huclangia.ga>
Subject: RE: Cancellation of PO
Attachment: PO_2002837727_288772.rar (contains "PO_2002837727_288772.exe")

AgentTesla SMTP exfil server:
mail.mehatinfo.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cff1cc3b02bf7d699b880ec9dbd3f4bdddb607cc0e84c956178d00f428fe86af/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 18:23:05 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7y4yoycx56wtg4ib3e5xu7uxxo3mb6mb2cmsvqxruapikh6q2xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cff1cc3b02bf7d699b880ec9dbd3f4bdddb607cc0e84c956178d00f428fe86af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cff1cc3b02bf7d699b880ec9dbd3f4bdddb607cc0e84c956178d00f428fe86af

(this sample)

AgentTesla

Executable exe 1023c7d9224250cd2a21a365f5b9a5f434180acd13fd22acda7d8b34915c5757

  
Dropping
MD5 865c4fcd489dbfca5aaaf7e74189f388
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1023c7d9224250cd2a21a365f5b9a5f434180acd13fd22acda7d8b34915c5757

Comments