MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b884e3bb98c60b81c280e7f545e96fdb78d2ff0574e25b79b4852d82d10ffe49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b884e3bb98c60b81c280e7f545e96fdb78d2ff0574e25b79b4852d82d10ffe49
SHA3-384 hash: 31c60b3b1c2f81f963c331c81966c2e63544553991ed4718cbab4b6039a7f55c4c915e4aadc0ce92ef6581c47aaf65ee
SHA1 hash: 45bf55205e66ea803f272fd4645cb85b07f4cdc7
MD5 hash: 2490dba9ff617415cdf49135178b370c
humanhash: pizza-fix-two-winter
File name:Sample Photos.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'044 bytes
First seen:2020-08-05 12:14:30 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:vPh9af5lCkuLvH7W/izdhOa3PkUUGdqaBoMp29jmK0D:3hcDCvH/oaTUyqv9jmKG
TLSH 08A423C47A9D1228D979422757288E0942F779B471ACC86249C7F893C2DB7BEEC3C761
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kellyservices.co.in
Sending IP: 185.222.57.166
From: Ulf Hellmuth <raksha_s@kellyservices.co.in>
Reply-To: Ulf Hellmuth <fasail.fmfashion@gmail.com>
Subject: NEW ORDER & Sample Photos
Attachment: Sample Photos.cab (contains "Zecostubb.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b884e3bb98c60b81c280e7f545e96fdb78d2ff0574e25b79b4852d82d10ffe49/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:16:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xccoho4yyyfydqua472ul2lp3n4nf7yfotrfw6nuquwyfuip7zeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b884e3bb98c60b81c280e7f545e96fdb78d2ff0574e25b79b4852d82d10ffe49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab b884e3bb98c60b81c280e7f545e96fdb78d2ff0574e25b79b4852d82d10ffe49

(this sample)

AgentTesla

Executable exe 99b14cfb554065990c24c0d35ec7a4ef07bfee5e4183deab7774ab44cb3e20b2

  
Dropping
MD5 bcfdafc7863d37f6b340530276843e0f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 99b14cfb554065990c24c0d35ec7a4ef07bfee5e4183deab7774ab44cb3e20b2

Comments