MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31518f241d9ddb6d582d673386f7e9ddd44de3e976fed51f1448e179071c7fcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31518f241d9ddb6d582d673386f7e9ddd44de3e976fed51f1448e179071c7fcc
SHA3-384 hash: 3626ea88d0f955f471970b16cf85772802f11db25c5125c51e0bf01b40af4b1c21d05d961e4df0eb3aec9137443f70f0
SHA1 hash: 2cfc944ebfc642178d7cd4f941563a8940a2d1cc
MD5 hash: 053a5dcfcaf78fb1f773ffcbc826cb4c
humanhash: yellow-indigo-speaker-juliet
File name:PDF_43795379326436.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'097'152 bytes
First seen:2020-05-22 08:50:06 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:Ltb20pkaCqT5TBWgNQ7agHviVNKSS6rbZ1gFYcfR20fsJe+6A:IVg5tQ7agPiV8abwFbsn5
TLSH A3A5DF1263DD8360C37E5173BA157741AEBBF82506A1F47B2FD8C93CAA201215E1E66F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.214
From: office@jinpao.us
Subject: Request for Offer from ABB PG Switzerland Ltd.
Attachment: PDF_43795379326436.IMG (contains "PDF_43795379326436.exe")

AgentTesla SMTP exfil server:
smtp.studlandstol.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 09:24:51 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 31518f241d9ddb6d582d673386f7e9ddd44de3e976fed51f1448e179071c7fcc

(this sample)

AgentTesla

Executable exe b99ab6571c625004df68a09401b8aa87d6e3c7b86195b6a1be7f15bf48a01f24

  
Dropping
MD5 70c02690cab6fe913fc0b77618565125
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b99ab6571c625004df68a09401b8aa87d6e3c7b86195b6a1be7f15bf48a01f24

Comments