MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccdd6fc7a745b1f611d096e6a49339adbfcbc59d0d95fb5a4a6c22d26e61889c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccdd6fc7a745b1f611d096e6a49339adbfcbc59d0d95fb5a4a6c22d26e61889c
SHA3-384 hash: 55c803f7c163d6d19be6dee8b697c2cdde3e3530ddcf26d68622707a57cfba7d1b97ff0ba1890496474632ffed7d8d0e
SHA1 hash: 36d7426c52f9590fb8dcbc4d2f6b5ecf9bda97f7
MD5 hash: 0c0cefe4fe1bc57eb04bd430aedde908
humanhash: burger-batman-beryllium-sodium
File name:Scan0012.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'298 bytes
First seen:2020-07-20 09:29:04 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:w5h5fCc+tDGXlBPiGhoZG/l7Om22HBSJI3ksfgc:I/f6tsikcG/l7ZtH8Jcgc
TLSH 6D8423C2A6816148D8EC39F0C873C496F8862FAC75A655EB83B93C372D43F775A67241
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.bontechnologies.com
Sending IP: 46.4.133.15
From: Finance Department <info@rneslo.com>
Subject: Re: Bank TT Copy
Attachment: Scan0012.GZ (contains "Scan0012.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccdd6fc7a745b1f611d096e6a49339adbfcbc59d0d95fb5a4a6c22d26e61889c/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:30:07 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ztow7r5hiwy7meoqs3tkjezzvw74xrm5bwk7wwsknqrne3tbrcoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ccdd6fc7a745b1f611d096e6a49339adbfcbc59d0d95fb5a4a6c22d26e61889c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ccdd6fc7a745b1f611d096e6a49339adbfcbc59d0d95fb5a4a6c22d26e61889c

(this sample)

AgentTesla

Executable exe 97bb08ab5ab612641d3744f726c9369b7cd5ddeaf4b6ddaab9ee8f3d2ee66013

  
Dropping
MD5 f8e24730ae79187b5b82a775e5640910
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97bb08ab5ab612641d3744f726c9369b7cd5ddeaf4b6ddaab9ee8f3d2ee66013

Comments