MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f790caf77bbf4a4a918ead10a24038ddb95d4116cdabbf0f57b51857389c4fa3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f790caf77bbf4a4a918ead10a24038ddb95d4116cdabbf0f57b51857389c4fa3
SHA3-384 hash: dd8a3803b68b7646b29b2f63e5ce9d59b01650a7a440e1f2beee8e99a1d439a74917a85f563de0ed53147e19051d1a3e
SHA1 hash: ec3ecdb5d6ec8b4cbddfef2d7ca6c98e8ce6c326
MD5 hash: 9bff9056d6264c5d6a20a8b5c234a40b
humanhash: north-orange-ink-uncle
File name:FT 735 - VS DDT 2347.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'031 bytes
First seen:2020-08-05 09:16:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:QucMGbEqvAfjPnOEJ6r8E6vRZsqYvVXJy3uWs:Quc1vATbJc87zcV5K1s
TLSH 5294236822256707D9A661F942CC7C57EA845C5B4CD0A9C4CBBF1E373204E962AF4EF2
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.cantalupilighting.it
Sending IP: 31.27.11.130
From: Hamza Ejaz Khan <info@ecodelnord.com>
Subject: Quotation
Attachment: FT 735 - VS DDT 2347.rar (contains "FT 735 - VS DDT 2347.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f790caf77bbf4a4a918ead10a24038ddb95d4116cdabbf0f57b51857389c4fa3/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:18:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66imv533x5fevemovuikeqby3w4v2qiwzwv36d2xwumfooe4j6rq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f790caf77bbf4a4a918ead10a24038ddb95d4116cdabbf0f57b51857389c4fa3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f790caf77bbf4a4a918ead10a24038ddb95d4116cdabbf0f57b51857389c4fa3

(this sample)

AgentTesla

Executable exe 6f873c8396d0097485898068e51d5b9bc771a109fbe95a4c261dea424374d114

  
Dropping
MD5 4e093ec8fa2756d9978383a957f27228
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f873c8396d0097485898068e51d5b9bc771a109fbe95a4c261dea424374d114

Comments