MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a37847017964680f85e5269d3fa6ab75d06fa2081b2ad09948a0e785dfab5f31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a37847017964680f85e5269d3fa6ab75d06fa2081b2ad09948a0e785dfab5f31
SHA3-384 hash: bcb9a3000d9302048d22e826aa59f08d72c2e5c08d4cbafd24b7020ee7ac872d2fd8b232eac99645ef36e8bd969be7de
SHA1 hash: aa0676aef2233c34a574ad58ea0b7826abcd9fc0
MD5 hash: 285447e12d4c5e444dda7004f5b8b43a
humanhash: uniform-nineteen-july-mockingbird
File name:INVOICE.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-09 18:34:15 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:7aU+Hg8Tk3nk0jskko0kkTmZj7U+Hg8Tk3nk0jskko0kkTmZjYUXG8+VAjpq6EqW:mUB57UB5YUjQAVzEZanbMYWM
TLSH 9345CEFE32649357C415B679846AC23547303C17A080E296BBDDFF8B35F2FA740265AA
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.allfrice.com
Sending IP: 45.95.169.51
From: Purchase manager<enquiries@scholasticgroup.org>
Subject: NEW ORDER
Attachment: INVOICE.IMG (contains "NEW ORDER.exe")

AgentTesla FTP exfil server:
asnbanknl.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a37847017964680f85e5269d3fa6ab75d06fa2081b2ad09948a0e785dfab5f31/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 18:36:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=un4eoalzmrua7bpfe2ot7jvloxig7iqidmvnbgkiudtylx5ll4yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img a37847017964680f85e5269d3fa6ab75d06fa2081b2ad09948a0e785dfab5f31

(this sample)

AgentTesla

Executable exe 92dcc5b8d659d632e41ab1f27b1d0ee2062d46c82a71d06a6c3c6c4e63c7293e

  
Dropping
MD5 adb66e3ff31d726b182d185d7f13897b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92dcc5b8d659d632e41ab1f27b1d0ee2062d46c82a71d06a6c3c6c4e63c7293e

Comments