MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 096d05642c1e92342e95b97825447c080d63be39c25e870c2a1ca8e17eeecb71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 096d05642c1e92342e95b97825447c080d63be39c25e870c2a1ca8e17eeecb71
SHA3-384 hash: 4e5ddb2c8a142b460aa891b3b2bf0acc4683548856e4d57b5c740297f1c7695dbf79557d64d307056e4957afc5968c91
SHA1 hash: 6ed949ed350c65b2c67327cc5d3df141748ed0c7
MD5 hash: 826818713790994d8e26f8c5762610cd
humanhash: monkey-kansas-zebra-golf
File name:technical requirement.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'444 bytes
First seen:2020-06-08 05:11:34 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:5Cdv6Uo8bX07hjpxe0bmzGKUsG6GdLzkzvB+e2:MkYb07hjpxe0YHG60LzkJ2
TLSH 5E8423915DCFF1288C5AD43FE0256B65EAF3721FD7E60949CCB1EE94846BC30A271A24
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: soluparts.de
Sending IP: 209.58.149.66
From: Roney BR <logistics@soluparts.de>
Subject: New Rfq
Attachment: technical requirement.cab (contains "technical requirement.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.67676.3353.29724.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:13:05 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bfwqkzbmd2jdiluvxf4ckrd4bagwhprzyjpiodbkdsuoc7xoznyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 096d05642c1e92342e95b97825447c080d63be39c25e870c2a1ca8e17eeecb71

(this sample)

AgentTesla

Executable exe f688b463a057afb9a38b9c380035f17579bc1f4b12b8041a5c5f388d11ff9158

  
Dropping
MD5 47ee6d7bbfce07dc6ef3534e002583f6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f688b463a057afb9a38b9c380035f17579bc1f4b12b8041a5c5f388d11ff9158

Comments