MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b70643568094ddfbca3107ce176b6725bdbf11fabffc33e6d0fa3ab36b21a66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b70643568094ddfbca3107ce176b6725bdbf11fabffc33e6d0fa3ab36b21a66
SHA3-384 hash: 2b67cb186cdc729221cd09e43e003e4604aa2ad50bb4933e6ae1fbceca77c4832ca39b97badf634eaa860b6fcab93b46
SHA1 hash: f614e3fb15697e8b4f37871de59a669b4a789490
MD5 hash: 0a62bca2412dd38781407e7aae30d2ac
humanhash: network-cardinal-sink-montana
File name:EMEANARK TECH RFQ - 164873.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'703'936 bytes
First seen:2020-08-04 11:04:25 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:VNA3R5drXdtQullZfbtFoFWqcyeVApMY5aRcKXwZ3:A5bQsEWgNG2aMZ3
TLSH 57751242B6C188B1E67229361939F725B97CB9201E34CA5FB3C80E6D9B34181E635F77
Reporter abuse_ch
Tags:AgentTesla Hostwinds img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-752042.hostwindsdns.com
Sending IP: 104.168.159.72
From: info@emeanark.com
Subject: EMENARK TECH RFQ - 164873 / VTECH PROJ #: PA-0724, END USER BRAZIL
Attachment: EMEANARK TECH RFQ - 164873.IMG (contains "EMEANARK TECH RFQ - 164873.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b70643568094ddfbca3107ce176b6725bdbf11fabffc33e6d0fa3ab36b21a66/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:06:08 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnyginlibfg57pfdcb6oc5vwojn5x4i7vp74gptnb6r2wnvsdjta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b70643568094ddfbca3107ce176b6725bdbf11fabffc33e6d0fa3ab36b21a66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4b70643568094ddfbca3107ce176b6725bdbf11fabffc33e6d0fa3ab36b21a66

(this sample)

AgentTesla

Executable exe 206e8466e10c69648fb2f5884e6d45a1e127019d58fd18988b40c1d7bfe9c116

  
Dropping
MD5 c7ea19e5aabd6cc018a89c1cf2283d7b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 206e8466e10c69648fb2f5884e6d45a1e127019d58fd18988b40c1d7bfe9c116

Comments