MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22addc437e4a68f229a637e6516668c7779918c10b1360ca8e5b5bd54bbcb6d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22addc437e4a68f229a637e6516668c7779918c10b1360ca8e5b5bd54bbcb6d4
SHA3-384 hash: 84040762383ea5f54c9f752a5658a5a5f45f84e04c66aa4a33fa184bdebe34e096252206a87a9d3b57b97c8521a28056
SHA1 hash: 2d25464441eff5e83e71e84fba5f35de413ddae0
MD5 hash: ea78b6acfbfe6f8b4c24777f1c554317
humanhash: sad-single-maryland-solar
File name:Bank swift INV8009092020791.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-15 13:47:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:8JvR9UOmsWoyvDQEFkPwBGesyn8oTBUh432OO5N3IsgQcu7K7NN138yIWmRn:qvR9omyLQEePeB8o9dmOO/9M6YVsvV
TLSH 70458C986E0C5EDCC87BD1F48544A3852D51EDB12921ED1D26FB322AC633FD6B0C96E2
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hardyinternational.us
Sending IP: 103.133.105.20
From: Roseline <purchase@hardyinternational.us>
Subject: FWD: 70% DOWN PAYMENT T/T (BANK SWIFT)
Attachment: Bank swift INV8009092020791.img (contains "Bank swift INV#8009092020791.exe")

AgentTesla SMTP exfil server:
mail.ilclaw.com.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34016426.19424.29719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:49:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekw5yq36jjupekngg7tfcztiy53zsggbbmjwbsuolnn5ks54w3ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 22addc437e4a68f229a637e6516668c7779918c10b1360ca8e5b5bd54bbcb6d4

(this sample)

AgentTesla

Executable exe 10685563fb0d52b8ca9f665512360a688085485c461cfeaed678a9376a9fe86a

  
Dropping
MD5 a58dfe0b26ab3e2d45cc9a6445edddb0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10685563fb0d52b8ca9f665512360a688085485c461cfeaed678a9376a9fe86a

Comments