MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b40ea41fc93384bec4827853aa82d9fca981b7c4444135dd84accdf29aec8a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b40ea41fc93384bec4827853aa82d9fca981b7c4444135dd84accdf29aec8a2
SHA3-384 hash: 42d73fef2d6f521b2dd633aa740568c8c71aa6124e403c56d12d97e97e6d8c184e9757f4f6fcb52678d9bcd62fab79dd
SHA1 hash: c50ba8e297efed02a526d739523001ebd3de4bfa
MD5 hash: cdafdf96124cc09db67af9981bd2a0e4
humanhash: tennis-chicken-lithium-juliet
File name:payment inv.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:495'616 bytes
First seen:2020-07-03 06:28:12 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:x+/Y0iBVq2WkO/lNkQX5hhJaEfGGnHLz+1cgtPpDmlMr4FVs/P4N71b9+ftCNlap:BBdWkkhX5DJaI9HL3mRKurH/PE9PNf
TLSH 1FB402340244FE65E17E5EB8B09024241F746523AB52F3AC7EC461E727EB3118F96B97
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.813.xhangzouli.casa
Sending IP: 164.90.184.177
From: Shabeer M. T <shabeermt@lamco.ae>
Subject: Re: Payment Assistance Due To Covid-19 Pandemic
Attachment: payment inv.img (contains "payment inv.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b40ea41fc93384bec4827853aa82d9fca981b7c4444135dd84accdf29aec8a2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:30:06 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnaouqp4sm4ex3cie6ctvkbnt7fjqg34ircbgxoyjlgn6knozcra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 2b40ea41fc93384bec4827853aa82d9fca981b7c4444135dd84accdf29aec8a2

(this sample)

AgentTesla

Executable exe 3d55648bf69f4687c8fb968c96ad82c702d6adc8c1391bd87aa60ad2a97d7beb

  
Dropping
MD5 7e9ef8d75a5bf897e54920d2e628fe67
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d55648bf69f4687c8fb968c96ad82c702d6adc8c1391bd87aa60ad2a97d7beb

Comments