MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f04ae44cc670cc0617db79aff029f1b5f73e6d137771339b5914be3e66adf967. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f04ae44cc670cc0617db79aff029f1b5f73e6d137771339b5914be3e66adf967
SHA3-384 hash: 006e051dac3c717caa3a4351217acf46791c082712f5c2da6b37ee3d73e430f7855a66f5aa51848d298f8c8146cd2289
SHA1 hash: 313c129df843c4d6a7dbd477d70147035e71d102
MD5 hash: edcd637ea1f3b6401ebd50dee3ec8373
humanhash: jupiter-may-bluebird-neptune
File name:CBO 17.03.2019 contract.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'916 bytes
First seen:2020-08-08 08:12:57 UTC
Last seen:2020-08-08 08:14:16 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:V1ahtw9FT3u8BeoGN0n16LN1O5JhHxMHXUlefXN1:jahm9FKl6sRkbNxMHEYPH
TLSH F894232F287538D36E45BC23F563427637336935A51F0538B0B84CC63E99957CAACB92
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: silverbrookcm.com
Sending IP: 156.96.44.186
From: "Bonnie Tse"<bonnie.tse@silverbrookcm.com>
Subject: Contract Order
Attachment: CBO 17.03.2019 contract.zip (contains "CBO 17.03.2019 contract.exe")

AgentTesla SMTP exfil server:
smtp.pharmecy.info:587

Intelligence

File Origin
# of uploads :
4
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.20179.16081.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f04ae44cc670cc0617db79aff029f1b5f73e6d137771339b5914be3e66adf967/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:14:14 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bfoitggodgamf63pgx7akprwx3t43ito5ythg2zcs7d4zvn7ftq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f04ae44cc670cc0617db79aff029f1b5f73e6d137771339b5914be3e66adf967

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f04ae44cc670cc0617db79aff029f1b5f73e6d137771339b5914be3e66adf967

(this sample)

AgentTesla

Executable exe 983642426c54efb09b590e6f4344483d07b99a9e3a2551d504d4293183d701c3

  
Dropping
MD5 ed3667dffbcf4a67e217942251c30dfb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 983642426c54efb09b590e6f4344483d07b99a9e3a2551d504d4293183d701c3

Comments