MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f143eb3bc2d77b7c26577d9602778294cfc51625dcf719a1b2c38aff5fd2cd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f143eb3bc2d77b7c26577d9602778294cfc51625dcf719a1b2c38aff5fd2cd4
SHA3-384 hash: 6da6acbe134bf5b4b801da520c106cda1dd95da17ef2083f630a037ed4d7c5c4c5d855d915bbb2abf0eb350ce0633a55
SHA1 hash: c6ce2351646ab7825b6e938623aa68245dd7c2cb
MD5 hash: 0156896d665f6925f1bfe3f0e28200d9
humanhash: may-carbon-wyoming-friend
File name:Product Specification.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-29 06:50:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:8ijhnOnmAr2OB0ycAa6LQfaP4R5/xo+n3XXwEyHZAWR26c5X9sUv+bt/k3TbLKb0:unmg2K0XdHO+nHABZYhxvbLJh
TLSH C1458C51B264C201DC7E57F4D46859F0077A7C66E832E25F6E897DE93BB33C10A26A0B
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.cablecolor.hn
Sending IP: 190.92.0.50
From: Luis Bottazzi <luisbottazzi@cablecolor.hn>
Reply-To: Luis Bottazzi <luisbottazzi@cablecolor.hn>
Subject: Product Specicfation
Attachment: Product Specification.img (contains "Product Specification.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f143eb3bc2d77b7c26577d9602778294cfc51625dcf719a1b2c38aff5fd2cd4/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:52:09 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4kd5m54fv33pqtfo7mwaj3yffgpyulclxhxdgq3fq4k75p5ftka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4f143eb3bc2d77b7c26577d9602778294cfc51625dcf719a1b2c38aff5fd2cd4

(this sample)

AgentTesla

Executable exe a011199cb8b7164445d166285b1b0ebc6df462f34de7ab41856a52f4f3465fbf

  
Dropping
MD5 793378d2a82aff79fe56ba179b3a3bff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a011199cb8b7164445d166285b1b0ebc6df462f34de7ab41856a52f4f3465fbf

Comments