MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f53ce702da37fe9720c8ee5e54fae93455516808ca376be2587362b2d6689d1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f53ce702da37fe9720c8ee5e54fae93455516808ca376be2587362b2d6689d1f
SHA3-384 hash: 9ae18dde5ac43e33819f7ed7e04c2eb19dc5f01c9937d27a9da7022983d73dc668b87f7977d2fa63c6b9ccc3e2ef3877
SHA1 hash: 7f96c1cff3356578c658d1ed5bbd1c93ed5032d1
MD5 hash: b79ff6ad90cf2219e3d36f3e0fae5446
humanhash: oscar-comet-bacon-sink
File name:SCHACHERMAYER INQ2.CAB
Download: download sample
Signature AgentTesla
Create hunting rule
File size:272'247 bytes
First seen:2020-05-25 08:32:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:DXFpQTACENUggcXSl29AMHIdgaogb3bC6cyhHH:DXXNCEOggcXSJWIhbLCGJH
TLSH 9644233A43F294318FBD3A4E8D5826300187F9C54BF5D8A57076583E83E2EBA44DA977
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: SPOL.S R.O. <info@schachermayer.cz>
Reply-To: SPOL.S R.O. <aahvanrooyen@gmail.com>
Subject: SCHACHERMAYER, SPOL. S R.O. INQ
Attachment: SCHACHERMAYER INQ2.CAB (contains "SCHACHERMAYER INQ2.exe")

AgentTesla SMTP exfil server:
mail.okgrocer.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.8593b1cec0cbf443.22190.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 08:36:24 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f53ce702da37fe9720c8ee5e54fae93455516808ca376be2587362b2d6689d1f

(this sample)

AgentTesla

Executable exe dfe2978764d493ac195ec5a39d99f998c1d69d9f68e25bbbe090d9b2f7cb97c2

  
Dropping
MD5 8593b1cec0cbf443f51b1be38eaba1e2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfe2978764d493ac195ec5a39d99f998c1d69d9f68e25bbbe090d9b2f7cb97c2

Comments