MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96e7e77f1bf0052ad463e334746fec8c5a80c5962a6577571f07fb96297c09fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96e7e77f1bf0052ad463e334746fec8c5a80c5962a6577571f07fb96297c09fb
SHA3-384 hash: 41cdb5c294fb3641944916e3c42d93a89665b1641866a42e8b15cba121c6865d697d3864c84d233f359d6b9ff6d5152a
SHA1 hash: 6149dc88129253f6a3641c09146519cbdd920b41
MD5 hash: abc8d9ef4263ceb43b064ae2022c22ec
humanhash: crazy-bulldog-undress-spring
File name:Ref 0180066743.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-31 16:05:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:JutrmZl4x/rwtgEuOfm9FqbiaYuSp/kyRf:Ytrg0+gdumXqb9Yvpj
TLSH 5F45F02C16644B66F52A06BF1C7661439F62D01F1122C2177EBC61EA173EB8C3D91FAB
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mwon.net
Sending IP: 69.64.67.236
From: PAGOS <pagos@grupodiaz.com.mx>
Subject: Re: DEVOLUCIÓN DE PAGO TT (Ref 0180066743)
Attachment: Ref 0180066743.img (contains "Ref 0180066743.PDF.bat")

AgentTesla SMTP exfil server:
mail.emifarma.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisB8F7976A9643.31083.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96e7e77f1bf0052ad463e334746fec8c5a80c5962a6577571f07fb96297c09fb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 16:07:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3t6o7y36acsvvdd4m2hi37mrrnibrmwfjsxovy7a75zmkl4bh5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/96e7e77f1bf0052ad463e334746fec8c5a80c5962a6577571f07fb96297c09fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 96e7e77f1bf0052ad463e334746fec8c5a80c5962a6577571f07fb96297c09fb

(this sample)

AgentTesla

Executable exe 86de94484346c6fefa6b2baa70af6e34cc91d845bd995640face3b580db9b07d

  
Dropping
MD5 b8f7976a9643bc6b2ec50cadc3b3b7a2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86de94484346c6fefa6b2baa70af6e34cc91d845bd995640face3b580db9b07d

Comments