MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cda985f8851b52b380377424ba3c5d9c864a3cfacc91a074fc66be6de28bc2cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cda985f8851b52b380377424ba3c5d9c864a3cfacc91a074fc66be6de28bc2cd
SHA3-384 hash: 1fea3b6a5ab8a06322a1d0d374155d51d5a944f4e775eedabef9a636e286236c0226543be049d6de31a4af39c80201c7
SHA1 hash: b95e89ad240497967386cff6daa73a77f11eaf45
MD5 hash: f7b83bb8d66be71bb20b9d5d6614d7dd
humanhash: iowa-nuts-march-dakota
File name:QUOTATION400562.exe.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'172 bytes
First seen:2020-06-17 05:55:23 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:nKyKV73Ja28U5yIV1s0CZ2lAP4GHa7pFWjHJ61igyw4wqfxu442NDZ9QC0J:KyWg1oyIw0CQ+AKkFU+LL4bNDoC0J
TLSH 069423F8C228FC7EB8EF064B674DDEFD6369C5926463580EAA22516818231D07F77943
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ysmtp02.mail.fullspace.ru
Sending IP: 185.72.146.40
From: yunus@pchpt.com
Subject: Inquiry-
Attachment: QUOTATION400562.exe.gz (contains "QUOTATION400562.exe.exe")

AgentTesla SMTP exfil server:
mail.alhmedipharm.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Generic.fc.30295.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:57:05 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwuyl6efdnjlhabxoqslupc5tsdeuph2zsi2a5h4m27g3yulylgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz cda985f8851b52b380377424ba3c5d9c864a3cfacc91a074fc66be6de28bc2cd

(this sample)

AgentTesla

Executable exe e080500f89c8e457d0d32d9e860764b10963527448c2104d13ba8bb98226b5d0

  
Dropping
MD5 c88bd9fafca7b91ec9c73f3bb55ede8e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e080500f89c8e457d0d32d9e860764b10963527448c2104d13ba8bb98226b5d0

Comments