MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 863e9092dd311928a0798f6734fb69205c554f77681d7e23207a01e470374661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 863e9092dd311928a0798f6734fb69205c554f77681d7e23207a01e470374661
SHA3-384 hash: 5d149412532ef8f574cea59931742fa24e7405e781b2fb3a3b92ab3ca26679d50bba0f3970b18d38b95ccec8f75dbf38
SHA1 hash: 1cc423166feeb96ebe5c7d0a933886ea7f641cfe
MD5 hash: 1ff3016d8d86b42c14c34d9aac110e7d
humanhash: island-quiet-bluebird-three
File name:PO# 7431-mendesak.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'621'440 bytes
First seen:2020-07-09 06:39:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:L1U95MorSjOQ6am6lDsp/kHpdTiAqboWyGDkz0b+ZtDVkQsUQx/VYb/3kSG:WrYOQxmpcHD0botGDi05Vsk
TLSH 3AC5E00472446CA3CF98ABBEF56A5D4482684C364FC2E14F21587AB6DFB728DEC450DE
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-139867.us-midwest-1.nxcli.net
Sending IP: 209.126.30.106
From: Tian <enquiries@vinta.com.sg>
Subject: PO# 7431-mendesak
Attachment: PO# 7431-mendesak.IMG (contains "PO# 7431.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.UTO.9022.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/863e9092dd311928a0798f6734fb69205c554f77681d7e23207a01e470374661/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 06:41:08 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qy7jbew5gemsridzr5ttj63jebofkt3xnaox4izapia6i4bxizqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 863e9092dd311928a0798f6734fb69205c554f77681d7e23207a01e470374661

(this sample)

AgentTesla

Executable exe e65f3e7d58650711f81d06e50e53ced4b636f08df0eed8019d7927e17fec9580

  
Dropping
MD5 8341d551a5b1665cbb0f65780530b20c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e65f3e7d58650711f81d06e50e53ced4b636f08df0eed8019d7927e17fec9580

Comments