MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf2f1141514cc8783837917fe5d7a137eba5fe181cf4b9fad8c08993fbf85fdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf2f1141514cc8783837917fe5d7a137eba5fe181cf4b9fad8c08993fbf85fdf
SHA3-384 hash: 8f67eed0560c747a966a24a995e75b80003f282b671f85449cefb7258225d9778828df93603d2fb7e22b15b7315db406
SHA1 hash: 5a86d096cf06228f18def1dc2b6537d0969a3aed
MD5 hash: 52abf2b8d673aaabe8bf270d69075683
humanhash: butter-finch-alaska-maine
File name:PO-067635 NICO.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:443'333 bytes
First seen:2020-08-21 08:29:33 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:8+QRuo3UPtfd+6WizDwQDPaY3zB9544AucX8fIkJKsh:8jRuoE9d+SzsjY/54L/2f
TLSH FE942300F9CADCFF32E71ECE99BCE05E1A84F946424B992C651C68DB7CC273289951D6
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email
From: =?UTF-8?B?WmhhbmdEYW4g5byg5Li5?=<zhang-liang@neusoftmedical.com>
Received: from neusoftmedical.com (unknown [199.102.44.136])
Date: 21 Aug 2020 10:29:24 +0200
Subject: =?UTF-8?B?UmU6IOWbnuWkjTpSZTogUmU6IDIwMjAgTmV1dml6IDEyOCBhbmQgTWFtbW8gUHJvamVjdA==?=
Attachment: PO-067635 NICO.7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf2f1141514cc8783837917fe5d7a137eba5fe181cf4b9fad8c08993fbf85fdf/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-08-21 07:54:17 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf2f1141514cc8783837917fe5d7a137eba5fe181cf4b9fad8c08993fbf85fdf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z cf2f1141514cc8783837917fe5d7a137eba5fe181cf4b9fad8c08993fbf85fdf

(this sample)

AgentTesla

Executable exe 90389790309ed963a0908cec1a9a6866ae0c6e41c8103454f3a311bc93a21125

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 90389790309ed963a0908cec1a9a6866ae0c6e41c8103454f3a311bc93a21125

Comments