MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab3f19514be24cd0835466cd35dbb8f8958df91b35c59db02ed13c6ad6c5a10b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab3f19514be24cd0835466cd35dbb8f8958df91b35c59db02ed13c6ad6c5a10b
SHA3-384 hash: 55a1ca5545c3d3656d5d4886b1576a4df336b565c90dd9a17a9a52df7c92e32331fd6eb691cd833abb7127143c1bd559
SHA1 hash: 8bacfe74d80c535ab9bdd2972cbd613775809649
MD5 hash: 2110f96b384a6cf4308f39c710cd4ddd
humanhash: utah-spring-coffee-bacon
File name:Payment transfer scan copy_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-25 12:48:46 UTC
Last seen:2020-05-28 19:45:12 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:GV1SbXnD1SH7slP/QMFMxOj5Prsb0ZKz2euY+MJ:GV1SbXnDH/QMFs+5PrxZ1W
TLSH 6F45121123FABB2FDD7F4FF2A5B1A50463F462660157EB893DCE22CD47863858621983
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp2.africa-online.net
Sending IP: 41.190.93.230
From: Accounts Payable <reservations@ufulugardens.mw>
Subject: Re: Inward Payment Notification (MT103)
Attachment: Payment transfer scan copy_pdf.img (contains "Payment transfer scan copy_pdf.exe")

AgentTesla SMTP exfil server:
mail.rbt.co.th:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.49420.2496.15311.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 22:38:25 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ab3f19514be24cd0835466cd35dbb8f8958df91b35c59db02ed13c6ad6c5a10b

(this sample)

AgentTesla

Executable exe 2ba12b607cf878b61039a3acfa39547bce7884717247321b0d52b570deea249b

  
Dropping
MD5 d48a149219e24db078bc7447cd6d3807
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ba12b607cf878b61039a3acfa39547bce7884717247321b0d52b570deea249b

Comments