MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20ced7a02cc49bd036fd2438e69bb23fd7a27dac638b88ef97e6916173afc7e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20ced7a02cc49bd036fd2438e69bb23fd7a27dac638b88ef97e6916173afc7e5
SHA3-384 hash: 875e10a56410f1f91c9ee3ae6a49ace9d82f684452f4f026f26e164f4cc116e0a4d3a9d4d3630de4c8a19615e5ac112d
SHA1 hash: 7c5823c8be98ccea2661fd614193c680d06f10b7
MD5 hash: 17dd8ab27cfae983761b718983b6ab81
humanhash: edward-coffee-comet-magazine
File name:PEDIDO PO 4500396589 IMG001.PDF.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'344 bytes
First seen:2020-07-16 18:39:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:otcLL3rGfEa5627BlS4jwcGJA7RqhWgQYCIZfjIGbs/MSJtzOwnscm/Frbw2yx+l:otcLL3EEa564lJsjPQ1UfJ4/fzOEHm/n
TLSH CE84236F0B8B5CEAA0C5C26017ADA3B4F4D8471CA5D6572872725BEE3E971A1231C1FC
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hr1830826226.reseller.mis.ovh.net
Sending IP: 51.83.111.105
From: Gonzalez, Juan <juan.gonzales@vibracoustic.com>
Subject: RV: PO 4500396589 - CD539 - VIBRACOUSTIC SA.U
Attachment: PEDIDO PO 4500396589 IMG001.PDF.ISO (contains "PO 4500396589 VIBRACOUSTIC SAU 07162020.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20ced7a02cc49bd036fd2438e69bb23fd7a27dac638b88ef97e6916173afc7e5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 18:41:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=edhnpibmysn5anx5eq4ong5sh7l2e7nmmofyr34x42iwc45py7sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 20ced7a02cc49bd036fd2438e69bb23fd7a27dac638b88ef97e6916173afc7e5

(this sample)

AgentTesla

Executable exe 6a6e6404124d7e49b0ffb8614f1124fe5c16a298d20d929fef2be45822b5dfe2

  
Dropping
MD5 1bad6f03d885c95838b31531d5ef5362
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a6e6404124d7e49b0ffb8614f1124fe5c16a298d20d929fef2be45822b5dfe2

Comments