MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dea729432fbfb2a7c9e6d40976076a5455ba8b57dbca9e29d1f990431e3b4722. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dea729432fbfb2a7c9e6d40976076a5455ba8b57dbca9e29d1f990431e3b4722
SHA3-384 hash: 28a0686b328380fdb3deaf6e2ea4ab47dfc8952ff5d91826fbfe8fdd6c2d10542676995fbd13dc0d0c4e45c945bd3ceb
SHA1 hash: 0593b31d1c7bae82d8a3535e45d664121476e3c2
MD5 hash: 108efcfb31d2a1f15320f1bf2c560f9c
humanhash: music-rugby-muppet-robin
File name:2colorisezzi TT.CAB
Download: download sample
Signature AgentTesla
Create hunting rule
File size:250'704 bytes
First seen:2020-05-05 11:24:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:8Ki3E3E8CXq3gCADJvTgqRBL/0S88ptt3A1QhoCt7N:8pEfwlCgLgqRBAhXCFN
TLSH 523423DF7A29F244C5117D3AA1E072865A6BC060933F674E4FF8849A73E426B11EDF84
Reporter abuse_ch
Tags:AgentTesla cab geo ITA


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sip1-210.nexcess.net
Sending IP: 209.126.18.174
From: Colori Sezzi <info@colorisezzi.it>
Subject: Ri: copia rapida della banca TT
Attachment: 2colorisezzi TT.CAB (contains "2colorisezzi TT.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.3153.22623.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 11:37:15 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 45 (37.78%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32tssqzpx6zkpspg2qexmb3kkrk3vc2x3pfj4kor7gieghr3i4ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip dea729432fbfb2a7c9e6d40976076a5455ba8b57dbca9e29d1f990431e3b4722

(this sample)

AgentTesla

Executable exe db6760631b1665a671c30a8e8c8ddeb28b76960d31485187a86f91fe48359129

  
Dropping
MD5 27c52341c6d9a8d45ca200cfc47f8fa2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db6760631b1665a671c30a8e8c8ddeb28b76960d31485187a86f91fe48359129

Comments