MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2067cee09631892c460b0cce1d9d3125a5544ce8e552d507117ebfcb5f26d8fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2067cee09631892c460b0cce1d9d3125a5544ce8e552d507117ebfcb5f26d8fa
SHA3-384 hash: c845f54950342904b623d0c804c2ecdcbde5c0e9512c6ec9e980acbfbcba5cf299bc7f33e8f1a9f9894e5d712eeaa8f3
SHA1 hash: 0d956c9d51639799d891228ede007ad61dbc94d5
MD5 hash: b6dd0201f73b45959ec6fd2f566ddca9
humanhash: johnny-bulldog-december-equal
File name:Statement Of Accounts.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:44'899 bytes
First seen:2020-11-26 06:51:37 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 768:har5Uv3jhVtWR5WasJpOSYySrGIckaMu6IRNf+44BRKTda5FDUwkq:YrSz70R5WasJpOPySg8uZKjaW
TLSH F213F19A902F419DE2AF29F9FC460C71D9567690CBC93CD897AC62395B77C3028A134F
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: c30atji5.mwprem.net
Sending IP: 61.118.29.167
From: Equalplas <equalplas.acc@hotmail.com>
Subject: OUTSTANDING SOA
Attachment: Statement Of Accounts.cab (contains "Statement Of Account.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2067cee09631892c460b0cce1d9d3125a5544ce8e552d507117ebfcb5f26d8fa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 06:52:08 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebt45yewggesyrqlbthb3hjrewsvithi4vjnkbyrp274wxzg3d5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 2067cee09631892c460b0cce1d9d3125a5544ce8e552d507117ebfcb5f26d8fa

(this sample)

AgentTesla

Executable exe 2d2996c0344c2ed157f9affb6468c803dc196b519574c945c8fe40e445418030

  
Dropping
MD5 e6f5720c61791304ad99987695c07d81
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d2996c0344c2ed157f9affb6468c803dc196b519574c945c8fe40e445418030

Comments