MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 620b9a7eb539245cf0f711df5494a7f9474543abd4a2ff2812649872798eec5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 620b9a7eb539245cf0f711df5494a7f9474543abd4a2ff2812649872798eec5b
SHA3-384 hash: f498d671e94df59b41c78677a7e75689c7b9089d7a0bf20fc205e056cbe2e953013b872af6fc74ba9e463c23a3d33c2b
SHA1 hash: 87702807e292c53466032ddf06631727657aeeba
MD5 hash: a869972bcb77f90107210044b1fbef5a
humanhash: lima-grey-football-tennis
File name:Scan_PO200210PO2002111.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:366'344 bytes
First seen:2020-10-14 15:54:50 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:vrFmlERgedEKYb2lTLPMuD+7wpvnvBxhTLKxTm5D6WvmiMjzwB0N2CvuDBoD/c:vrFSbsL00ewdvFHsTmJc/d1uD0/c
TLSH 3C74239B399FFA819EC8E62C036985B1610364923581F001BB3CED9EF534BDAD1B467D
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: avvalves.com
Sending IP: 23.108.57.133
From: Amin<amin@avvalves.com>
Subject: RE:For Your Kind Attention- Ref: PO200210 & PO200211
Attachment: Scan_PO200210PO2002111.cab (contains "Scan_PO200210&PO2002111.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3179.9221.29457.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/620b9a7eb539245cf0f711df5494a7f9474543abd4a2ff2812649872798eec5b/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 12:06:38 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mifzu7vvhesfz4hxchpvjffh7fdukq5l2srp6kasmsmhe6mo5rnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/620b9a7eb539245cf0f711df5494a7f9474543abd4a2ff2812649872798eec5b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 620b9a7eb539245cf0f711df5494a7f9474543abd4a2ff2812649872798eec5b

(this sample)

AgentTesla

Executable exe e9fe333b16d9d8f92248691f466ff758562fe434e801be39834023f4492103e3

  
Dropping
MD5 680f4f9e45281d4728b89c882aae21f7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9fe333b16d9d8f92248691f466ff758562fe434e801be39834023f4492103e3

Comments