MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04db2c0eb9bdfe5fced31a488a0895f5041909c745530cffdece825df29ca99a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04db2c0eb9bdfe5fced31a488a0895f5041909c745530cffdece825df29ca99a
SHA3-384 hash: e1e70f42bdedbdb616718ae588eb0dc6fcc2492f10a87ee59bb6473b35c941c38142d7c5ab94d4b419bdc11b0ff7f740
SHA1 hash: 2da2717641dcd5fac760228baa3d55a86dbb926a
MD5 hash: 7608de8a84264cf37dbbfaccfbd38b92
humanhash: hamper-pasta-early-montana
File name:Picture Items Order.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-05 07:49:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Eo+K+mkqvbqgjW7ooxcQLG9bsXfY6V4BKf:4K+mk0WNxcWQ
TLSH E245DF0C76A1654AF66A1E3F5C7145838E12FC1FC935D64B39BE32284B7E68DAC60F60
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: v238210.serveradd.com
Sending IP: 101.100.238.210
From: Admin-Yulia <yulia@nliid.com>
Reply-To: blessing@energistx.com
Subject: RE: Item Request QUOTE
Attachment: Picture Items Order.img (contains "Picture Item needed.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04db2c0eb9bdfe5fced31a488a0895f5041909c745530cffdece825df29ca99a/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 01:45:38 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=atnsydvzxx7f7twtdjeiucev6ucbscohivjqz766z2bf34u4vgna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/04db2c0eb9bdfe5fced31a488a0895f5041909c745530cffdece825df29ca99a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 04db2c0eb9bdfe5fced31a488a0895f5041909c745530cffdece825df29ca99a

(this sample)

AgentTesla

Executable exe 945d286768ca31b369717785d588898140fecafcbd422d862dc421a88c933cd4

  
Dropping
MD5 e7aca6d424e2ea75c1be99004d91b007
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 945d286768ca31b369717785d588898140fecafcbd422d862dc421a88c933cd4

Comments