MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c413e49fed9fcdea95ca989436a01df16d69051c2dfccc838f941074902d911. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c413e49fed9fcdea95ca989436a01df16d69051c2dfccc838f941074902d911
SHA3-384 hash: cee84a185dbdbca174c3efb00c703ad3f52a876f491653bbe7023a7a390304e91b8c39c482d4bd23e9b8c2787eb7ab9b
SHA1 hash: a9f52ba569cc556bf24d742597ec042d9697e3ed
MD5 hash: 1a65e789518974db7060412cf54a0a59
humanhash: hotel-carpet-blue-alpha
File name:Bank_payment_advice_MT103_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-22 09:22:02 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:XNHr2tFGcPUq2iNSXkZ5VwqU/MxLVlRJEtt6iD:X4Gccq1SkOXMxL3RJEtt6i
TLSH 7045D010EBF806D9DB6847BAD4611410A7B6791E63EAE70D3B89F1DC0B22B815717F23
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx0.oktodigital.com
Sending IP: 185.174.168.61
From: no-reply@hsbcbanking.com
Subject: Inward Remittance Payment Advice Notice[MT103]
Attachment: Bank_payment_advice_MT103_pdf.img (contains "Bank_payment_advice_(MT103)_pdf.exe")

AgentTesla SMTP exfil server:
mail-out.cytanet.com.cy:587

AgentTesla SMTP exfil email address:
jonathanashe01@gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c413e49fed9fcdea95ca989436a01df16d69051c2dfccc838f941074902d911/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 09:23:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nrat4sp63h6n5kk4vgeug2qb34lnnecrylp4zsby7faqosic3eiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 6c413e49fed9fcdea95ca989436a01df16d69051c2dfccc838f941074902d911

(this sample)

AgentTesla

Executable exe bc07064a72812e0bef060dee9886ba7d06969c22a6ab8459f2682441142e8dc9

  
Dropping
MD5 20758038b5d11ae2ecaafdb53924ad88
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc07064a72812e0bef060dee9886ba7d06969c22a6ab8459f2682441142e8dc9

Comments