MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c04e7e98b6457721d6abaaf4503a1237a01067e1bf6b0dcbe419afb9bfe6039. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c04e7e98b6457721d6abaaf4503a1237a01067e1bf6b0dcbe419afb9bfe6039
SHA3-384 hash: 24f8c988b4554bf6ace3387d87e126c7da9e203ec8356c88b8ccca045aeee71ca612e6685f29b055270d9cc7f1b257c1
SHA1 hash: 9463d5bff3c90d360dd6205e5affe29fcb7531f1
MD5 hash: c1eb3bd703f545387531b278a515600a
humanhash: mirror-oranges-mango-ohio
File name:Transfer Form.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-22 08:07:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:FFLratDdPUm2iNSherS1wkNJVZk0ci948LjP:FGdcm1ywkPvkKN
TLSH 61459DE0E77486C9E7A702B5E47280626BB2761D4BDAC60D3BA5F79C0E723450317E1B
Reporter abuse_ch
Tags:AgentTesla Endurance img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: PAY-U <enquiry@oxy99.in>
Reply-To: PAY-U <account@payu.com>
Subject: INCORRECT BANK DETAILS FOR PAYMENT
Attachment: Transfer Form.img (contains "Transfer Form.scr")

AgentTesla SMTP exfil server:
mail.northwestpowdercoating.co.uk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c04e7e98b6457721d6abaaf4503a1237a01067e1bf6b0dcbe419afb9bfe6039/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 08:09:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jqcop2mlmrlxehlkxkxuka5ben5acbt6dp3lbxf6ignpxg76ma4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4c04e7e98b6457721d6abaaf4503a1237a01067e1bf6b0dcbe419afb9bfe6039

(this sample)

AgentTesla

Executable exe d8bc45dfe42dc6266ac8e05d9e00206c3c4997dd2c287bb5ef1d4bb8862b8d02

  
Dropping
MD5 ced902a2157bec84634596ef1a455d05
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8bc45dfe42dc6266ac8e05d9e00206c3c4997dd2c287bb5ef1d4bb8862b8d02

Comments