MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c00a6e2665ccb18396e288272b20cec950b0a96c6ba6d78b60ec002fb13cceea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c00a6e2665ccb18396e288272b20cec950b0a96c6ba6d78b60ec002fb13cceea
SHA3-384 hash: 099ba93ee418e7bab65cfdb4b63e7e39f36e5539cceaf37a61219602f61811bb44476b5f3c7de0da086b62d2cf86cca8
SHA1 hash: 3661ed65d092670416df7f086774b15e0184dd83
MD5 hash: 54bd49be93dfc65157cbddd21cae42f5
humanhash: bluebird-sweet-purple-artist
File name:Scan 0008052020.uu
Download: download sample
Signature AgentTesla
Create hunting rule
File size:446'273 bytes
First seen:2020-05-08 08:13:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:INLiQOvfRVG73vvePBLmFZVhJx/w/4Ir3Ji:IGRmaBLyJZIhc
TLSH 1894232F0DFBAB7353C909E66D252C84FA8671EE488C566112C6250E07B37AE54C9F4F
Reporter abuse_ch
Tags:AgentTesla uu


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mafemobile.com
Sending IP: 95.211.208.50
From: Ali Shehab <poonam@mafemobile.com>
Reply-To: Ali Shehab <artesanosdalvino.alberto@gmail.com>
Subject: RE: Pending Orders
Attachment: Scan 0008052020.uu (contains "Scan 0008052020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 08:36:15 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yafg4jtfzsyyhfxcratswigozfilbklmnotnpc3a5qac7mj4z3va._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c00a6e2665ccb18396e288272b20cec950b0a96c6ba6d78b60ec002fb13cceea

(this sample)

AgentTesla

Executable exe dd1b5d3e6e56c8b5fceabda45b1a1f9a8a8da54f8cfda42b0c207d18aa0cdc5f

  
Dropping
MD5 242724ac01a3f5d6afa2627eddd73228
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd1b5d3e6e56c8b5fceabda45b1a1f9a8a8da54f8cfda42b0c207d18aa0cdc5f

Comments