MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 395b02b9a554fc2bf9e7877b240758375fa3fe8cc362f8f5731581de1b8a2080. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 395b02b9a554fc2bf9e7877b240758375fa3fe8cc362f8f5731581de1b8a2080
SHA3-384 hash: c791b4f7d498ba7e90c6e66d0ea8d6d085fad9c4f9969b173c668e3eade06886f8e622303e9846d8822eb613eb7b03cd
SHA1 hash: ae729bae3a78e97c824d7917d86a0f55bef1238f
MD5 hash: 2122a4e451047a0722114217491b729d
humanhash: zulu-pennsylvania-carpet-arizona
File name:PO-03-07-2020c.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-03 06:54:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:MBpjmke6JHr3Ot6WVQ2zjg3v9uJEZKKWUAqU9AhNBPHMJ0h7Vjnj8c4QTh89bs:kjrJrC6WVOfoJvK3TU9oPHzj4bQTh8
TLSH 9345BE712244EEDCE4395A39E07289F61C2B3C5FC664D64F3D8E7E643AB2342425B993
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtpironprot-3-122.vip.sina.com
Sending IP: 202.108.3.135
From: 邮件帮助中心 <sanlongda@vip.sina.com>
Reply-To: sanlongda@vip.sina.com
Subject: PO-03-07-2020c
Attachment: PO-03-07-2020c.img (contains "Quotation.exe")

AgentTesla C2:
http://osh.coura7ge.com//inc/62085b5761c528.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/395b02b9a554fc2bf9e7877b240758375fa3fe8cc362f8f5731581de1b8a2080/
Threat name:
ByteCode-MSIL.Trojan.Avemariarat
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:56:08 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfnqfonfkt6cx6phq55sib2yg5p2h7umynrpr5ltcwa54g4kecaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 395b02b9a554fc2bf9e7877b240758375fa3fe8cc362f8f5731581de1b8a2080

(this sample)

AgentTesla

Executable exe 38d8781428897545daf9057be9a4da040286b4ecb049a76e9b00eed21ecb3e1a

  
Dropping
MD5 f771b49b3f993686abc5f796410a6118
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38d8781428897545daf9057be9a4da040286b4ecb049a76e9b00eed21ecb3e1a

Comments