MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69b726951da9c96a39c0b620e4acb904d07ca24afe6161435bf3038a13da6ed6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69b726951da9c96a39c0b620e4acb904d07ca24afe6161435bf3038a13da6ed6
SHA3-384 hash: 6bbb8cefbd05255346b7011d4360ad7df6849e0fb1e050d05ed1addceae640857c9de20b453387397bb116b5ab48a6eb
SHA1 hash: 952533b5e83025a306c96db0100a229f957c40cd
MD5 hash: dba3379e8fcc62b5962b7bc7c6f0ae86
humanhash: lion-nevada-wolfram-friend
File name:payment5.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-26 11:34:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:VzXQB3oWPAlfGhltnC4gqL542fbSgzr0Z:JE3oWIfG0vwzbTzoZ
TLSH DE45015037F84B5AE9DE0BFE65229100173AF66A70A6D70C7A5D71EC0F237848B51BA3
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: secure.zrl.com.zm
Sending IP: 216.194.164.118
From: misheck.banda@zrl.com.zm
Subject: Urgent!
Attachment: payment5.img (contains "payment.exe")

AgentTesla SMTP exfil server:
mail.worldafricasafaris.com:587

AgentTesla STMP exfil email address:
info@worldafricasafaris.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis2A46FD19BDA3.9064.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69b726951da9c96a39c0b620e4acb904d07ca24afe6161435bf3038a13da6ed6/
Threat name:
ByteCode-MSIL.Trojan.SchInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 11:35:33 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ng3snfi5vhewuooawyqojlfzatihzisk7zqwcq236mbyue62n3la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 69b726951da9c96a39c0b620e4acb904d07ca24afe6161435bf3038a13da6ed6

(this sample)

AgentTesla

Executable exe 5dc1d79fcbce0ea9bdef1de3289b95c0f8d7e3d6ece49b6e7526a46d0a2ccbd8

  
Dropping
MD5 8be0b6d19b601c07b8579cb6a1dd80e3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5dc1d79fcbce0ea9bdef1de3289b95c0f8d7e3d6ece49b6e7526a46d0a2ccbd8

Comments