MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f7321b2142ae6e691b6ec36e3547fc1a286ccda0074c15c5d30f1ce3b004026. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f7321b2142ae6e691b6ec36e3547fc1a286ccda0074c15c5d30f1ce3b004026
SHA3-384 hash: 086e4ad6cf0ad2b391d292c6d36c3d8e0a913635591fd4a6aec42da5ab48ebaa4953ed3b9ee56454d8bd3776d84ad911
SHA1 hash: 97367cd0f641c77a7aefe3b54936be4886027519
MD5 hash: e341db392bc55252d0298e4bafe6c396
humanhash: washington-white-tennessee-avocado
File name:Payment_TransactionSummary.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-11 08:09:25 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:Z9qfCokPcwaX0iljH5HoBvlU2/4vkFVE:ZWxkwkF
TLSH 1C454AB1702C96ACD06476FA1640D42DCBBC9A1D60B5E6981CCE6CC687EBF97C0B0D5E
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudlinux03.twservers.net
Sending IP: 60.249.109.20
From: Linda < islee@btvlab.co>
Subject: Payment_TransactionDetails
Attachment: Payment_TransactionSummary.img (contains "Payment_TransactionSummary.exe")

AgentTesla SMTP exfil server:
smtp.jpme.org.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45506.9719.4720.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Avemaria
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:36 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f5zsdmqufltonenw5q3ogvd7ygrintg2ab2mcxc5gdy44oyaiata._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 2f7321b2142ae6e691b6ec36e3547fc1a286ccda0074c15c5d30f1ce3b004026

(this sample)

AgentTesla

Executable exe 2dee48503995eb6a1fc38e807bea655d420c181e9b832ca5d52676c8cd527394

  
Dropping
MD5 6623e9cdcd39acf7be13a24b494cac26
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2dee48503995eb6a1fc38e807bea655d420c181e9b832ca5d52676c8cd527394

Comments