MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 007266369d04dcabe0ea751d753122ce358622f389a2b1a4dbf5358f4b3d8235. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 007266369d04dcabe0ea751d753122ce358622f389a2b1a4dbf5358f4b3d8235
SHA3-384 hash: 544053744d462a13fe9c60920fd4482e4ba90cfbab8a957eba3c6fe5f184978b29aee4f3142578e9def239f037d43b77
SHA1 hash: 35d710e5af685c1380d6db113c1004be9f2b8426
MD5 hash: 03fa9489986e9dd434f6a10e540a8118
humanhash: social-skylark-helium-golf
File name:Invoice 19052020092512.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:739'328 bytes
First seen:2020-05-19 09:51:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:H63e53HHeUsLitBcEJD6LpCqIBhKfZ2aGCA1D6tbcYJRb6e8kGbn7eEk5:H63eJnewcEt6R0KfTGCA1DUgL
TLSH 3FF45B3977817825D03C897260A65A81A2BAA9433A51C74F3FCE675CAF033CF3B56359
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-109205.us-west-1.nxcli.net
Sending IP: 173.249.144.251
From: FETIH TEKSTIL <info@lichtblick-foto.de>
Subject: Confirm Bank Details
Attachment: Invoice 19052020092512.img (contains "Invoice 19052020092512.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 10:35:40 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=abzgmnu5atokxyhkouoxkmjczy2ymixtrgrldjg36u2y6sz5qi2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 007266369d04dcabe0ea751d753122ce358622f389a2b1a4dbf5358f4b3d8235

(this sample)

AgentTesla

Executable exe a8727f243c176aed101cb868a8141094786d42bae8aae66e0eb275063f0e1a9f

  
Dropping
MD5 52d5190b4e6619136ee385af062ec607
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8727f243c176aed101cb868a8141094786d42bae8aae66e0eb275063f0e1a9f

Comments