MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97f312417f59be41485a5bd02192e7aca4a501d48fdfd4bd69394b8cbc63095c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97f312417f59be41485a5bd02192e7aca4a501d48fdfd4bd69394b8cbc63095c
SHA3-384 hash: 24080c5251ba623c0d1d2c4bfb02d0d23a5623ea5621b171252e745a886fe3df51324de67cefbfd5db4c5795e3f29a7e
SHA1 hash: 72db0f9324dcc5075ff32b27e3984e9eea4ace14
MD5 hash: 36ea0d5e6a1c87437c79c8250ad22490
humanhash: video-idaho-victor-butter
File name:RFQ-2251.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:540'672 bytes
First seen:2020-07-22 09:41:44 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:wyIHr2t9sru8PUm2GhNAr/lvlf0TLtIpoP1bWMQqZqH5DmZ7z/hurtaMDJvcx4M7:wNHr2tz8PUm2iNSczy58bhu0SKdIN+
TLSH 4EB4CE10E7B807DADB6947BAD0654550A7B6691E23EAE30D3B8AF0DC0B32B414713F67
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mawums.com.gh
Sending IP: 23.81.246.122
From: <babs@mawums.com.gh>
Subject: RFQ-ENQUIRY NO2251
Attachment: RFQ-2251.img (contains "RFQ-2251.exe")

AgentTesla SMTP exfil server:
mail.itdone.cz:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97f312417f59be41485a5bd02192e7aca4a501d48fdfd4bd69394b8cbc63095c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 09:43:08 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7zreql7lg7ecsc2lpicdexhvsskkaour7p5jpljhffyzpddbfoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 97f312417f59be41485a5bd02192e7aca4a501d48fdfd4bd69394b8cbc63095c

(this sample)

AgentTesla

Executable exe 4bebecd4e0286af21b88e3b1d71b34f9567e8c21e99bb0145ad718a0d7353b11

  
Dropping
MD5 a8426b5bad6bc128155701a777d03900
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4bebecd4e0286af21b88e3b1d71b34f9567e8c21e99bb0145ad718a0d7353b11

Comments