MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfa7ad839196aa642475e972db8d360cf7b219e10b304ecd8cf9c7a0787a2ad7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfa7ad839196aa642475e972db8d360cf7b219e10b304ecd8cf9c7a0787a2ad7
SHA3-384 hash: bc8e1dfa4697f41984ef67801937706abdcb7627fadbfbd09e713d4a3fd2b7fa2e2523918e12c66aca22bf5c803bf496
SHA1 hash: 2fca50778534cdc8c379988f0a6fc3cea5f6f756
MD5 hash: 698fcca9631f313cd1a4e6da6269760d
humanhash: mobile-oranges-angel-victor
File name:CDO1029-022019 PURCHASE ORDER_PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'833'555 bytes
First seen:2020-05-05 11:01:40 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 49152:ZqGyPmgyg/0/OiAy3SGfC7Diajdt0EjIKWark0pB:gGy70/ttwDiykw0ipB
TLSH 5B85333D4AC048549AF233DABFD735173D2614A4C9BD169C931BEA831C99F92387A2CD
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing :

HELO: achilles.noc.ntua.gr
Sending IP: 147.102.222.210
From: KangQian Wong <rs12704@central.ntua.gr>
Subject: RIT-CDO1029-022019 PURCHASE ORDER
Attachment: CDO1029-022019 PURCHASE ORDER_PDF.z (contains "CDO1029-022019 PURCHASE ORDER_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 11:37:12 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6t23a4rs2vgijdv5fznxdjwbt33egpbbmye5tmm7hd2a6d2fllq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z cfa7ad839196aa642475e972db8d360cf7b219e10b304ecd8cf9c7a0787a2ad7

(this sample)

AgentTesla

Executable exe 812efd5114e9e1d9ae0898435aa593322a4ef9a39ddd1befe6fc9382ed1cfc0f

  
Dropping
MD5 51a186f64b59903d7217774720d0c34d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 812efd5114e9e1d9ae0898435aa593322a4ef9a39ddd1befe6fc9382ed1cfc0f

Comments