MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 134df3863d5b2fdb300b3202ea1bb85a5bbd648c2aaa6ab299add85f7e640b79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 134df3863d5b2fdb300b3202ea1bb85a5bbd648c2aaa6ab299add85f7e640b79
SHA3-384 hash: ba88611fbf80391bcc941c0ca5efb6e58729f3ad2b55c7612f10d25453997b9067b18a1afb34fccb39d1aad3ed03dd1b
SHA1 hash: ff7308cb1747fe15dce4aaf46bc1bd2098f68fbb
MD5 hash: 6ac9a3e1d0dc972b7dae836b36216772
humanhash: river-blue-green-tennessee
File name:INQUIRY_17062020050005.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:651'264 bytes
First seen:2020-06-17 06:12:06 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:8Zm49UNNMYcDoYuJnmfU8RD1QkaAYwWWwoUn7zwONfL5:m9V+tJoTr1ET7MONf
TLSH 24D43A1E7A447806D13C093380EA6E906673AA477B01CB0F7ADD576CAF2379B371629D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-401319.us-midwest-1.nxcli.net
Sending IP: 209.87.159.195
From: officebgd@medicodomus.rs
Subject: Kindly Send Price List
Attachment: INQUIRY_17062020050005.img (contains "INQUIRY_17062020050005.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.18171.12121.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:24:12 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cng7hbr5lmx5wmalgiboug5yljn32zemfkvgvmuzvxmf67tebn4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 134df3863d5b2fdb300b3202ea1bb85a5bbd648c2aaa6ab299add85f7e640b79

(this sample)

AgentTesla

Executable exe 8ac04f1edad3360a1775f325e346acd0950cf28d49d6bb083191c899d9528d76

  
Dropping
MD5 0f54223b84f946a41e838b13ea457021
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ac04f1edad3360a1775f325e346acd0950cf28d49d6bb083191c899d9528d76

Comments