MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4aded768d38a0f9fdfeb2c83a33e32d3b9ca12370006ded91019a2c5ab706857. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4aded768d38a0f9fdfeb2c83a33e32d3b9ca12370006ded91019a2c5ab706857
SHA3-384 hash: 9bf35c0e71142d776363cd1c7613cfd0dabca3874f977a74e4608c943aa433ff655a0b894a6b4103c326bd38d351f89b
SHA1 hash: ebe0c0048f7e97ca3a49d50e81f55ccf73afc143
MD5 hash: 83a520d79116c1c44033a7b7716699e1
humanhash: twelve-uniform-grey-mike
File name:Invoice.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-02 07:49:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:EFXtmDZHUXvDlBMt5K8RQaYHyDANG9UgcUbFavNX+7M:WXtmD2XxYKGQa5DsGaUkq
TLSH 7545E02067FC9328FDBE1A71AEB502041733B8A86976D75E265C605E1F77F808B91732
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tutanota.com
Sending IP: 193.142.59.130
From: Cali <calibros@tutanota.com>
Reply-To: calibros@tutanota.com
Subject: Inquiry
Attachment: Invoice.img (contains "Invoice.exe")

AgentTesla C2:
http://arlk.polisamo.com//inc/a4c5ac525cbadf.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WQV.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4aded768d38a0f9fdfeb2c83a33e32d3b9ca12370006ded91019a2c5ab706857/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:51:14 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlpno2gtrihz7x7lfsb2gprs2o44uerxaadn5wiqdgrmlk3qnblq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4aded768d38a0f9fdfeb2c83a33e32d3b9ca12370006ded91019a2c5ab706857

(this sample)

AgentTesla

Executable exe 241ae997ca6908aa0e3eaf306ec63193fd98243f055e770ae0e2180a5605ee72

  
Dropping
MD5 0d89ced9a825e9753064ff97a2dc2dd3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 241ae997ca6908aa0e3eaf306ec63193fd98243f055e770ae0e2180a5605ee72

Comments