MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f80c2c24491dbc01f8f449347d147c8fde0d54412fdd0385253738df37a99471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f80c2c24491dbc01f8f449347d147c8fde0d54412fdd0385253738df37a99471
SHA3-384 hash: 112b67bd3b31eaf3d54ea5a4f24898471ae13e2ff419a294431e048e8aad3ee24e906134f201dfdcdaf179b45b126665
SHA1 hash: ec1bfc53d74ca41d8a9fcf951e6ae214c183393c
MD5 hash: 54b92ffcf56009bc9fed993cbfb7b8ee
humanhash: beryllium-venus-potato-missouri
File name:INQUIRY ORDER.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:567'428 bytes
First seen:2020-08-17 13:45:56 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:cB1CFCeY8H4VHUkyj8vRq2rcLqjiN+7UUVdBxZbL4QJbRT/5dg:a1CxY8HwxyjlN2UUVdrnTg
TLSH 42C4231842C50437863DAB1F0D06C5793A648BE631508ACFB94B8B9B4535F1E27DEBEB
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "MS ATIKAH" <info@520.pinotvineryms.cf>
Reply-To: kelveneric88@gmail.com
Subject: MULTI-IMPACT/INQUIRY ORDER
Attachment: INQUIRY ORDER.gz (contains "INQUIRY ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.8809.17219.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f80c2c24491dbc01f8f449347d147c8fde0d54412fdd0385253738df37a99471/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:28:38 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7agcyjcjdw6ad6huje2h2fd4r7pa2vcbf7oqhbjfg44n6n5jsryq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f80c2c24491dbc01f8f449347d147c8fde0d54412fdd0385253738df37a99471

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz f80c2c24491dbc01f8f449347d147c8fde0d54412fdd0385253738df37a99471

(this sample)

AgentTesla

Executable exe c236cbc67f0375086f8b217b917cd5dfd5932e811f29a2b7cbf5cd29f2bab338

  
Dropping
MD5 f5e39324c5f457debfc29d337e8a892d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c236cbc67f0375086f8b217b917cd5dfd5932e811f29a2b7cbf5cd29f2bab338

Comments