MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcc91a22edbb555263dd5f7531ddc1cc467e53c5cf3c06fd5891488e2089e784. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcc91a22edbb555263dd5f7531ddc1cc467e53c5cf3c06fd5891488e2089e784
SHA3-384 hash: 4dd096597ecdb792838f3f2cc669e6ed3541c159dfbcc60221488eb6f77c3540e63e98e8326d0b7686604cbe9893906a
SHA1 hash: a6467ac1827055504f4f176cd6cda6f03b13785a
MD5 hash: 965f754553cfae0dca68e29195bcc306
humanhash: helium-lake-oranges-sierra
File name:pedido urgente.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'591 bytes
First seen:2020-05-27 17:59:38 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:GiCm01JzWTOhV8pxDtuyBstMLxyCGQrmIn/AqDwLvzQYls4+XOmHSo/iTyD1GHV8:xCmsJzWTgEgBWdyClKY/RwLvojXONo/n
TLSH 9D842333E7B5749CAD3D6CB0DAFC4E8520D216504A840387A3B679D4857B2680DA3B7F
Reporter abuse_ch
Tags:AgentTesla cab MailChannels


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bee.birch.relay.mailchannels.net
Sending IP: 23.83.209.14
From: Gerente Financiero <finanzas@extintoresyseguridad.com>
Subject: pedido urgente
Attachment: pedido urgente.cab (contains "pedido urgente.exe")

AgentTesla SMTP exfil server:
smtp.capeqlc.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Generic.fc.25527.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 02:35:45 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab fcc91a22edbb555263dd5f7531ddc1cc467e53c5cf3c06fd5891488e2089e784

(this sample)

AgentTesla

Executable exe e53b85600f2e1d2c612854eb25aa5ebb3cf93a966aef11b22e186f65cb097506

  
Dropping
MD5 027ec3c777c8acb409bf348c6fbed620
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e53b85600f2e1d2c612854eb25aa5ebb3cf93a966aef11b22e186f65cb097506

Comments