MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b137b1fbdf2b830a6f9efa754e4db3fa26fa1eb1c46d4fed1b6e02887f673cb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b137b1fbdf2b830a6f9efa754e4db3fa26fa1eb1c46d4fed1b6e02887f673cb5
SHA3-384 hash: a145e520a5c5677bc6db934956a1e833fa3f7451ff5b9edb4f77e55ec051cc73b3b4347a579e811585ef917f748f0bd5
SHA1 hash: b4ed9b73b9a5d82dcb297211fcc37993583e7a01
MD5 hash: 7d9d48e9ccb7501d1bea33d0c7a26f08
humanhash: pluto-don-leopard-jupiter
File name:Re_Fwd Payment.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-10 07:27:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:WmPOkh3PtS7oO4sVLsmclBjMbyFwFf6sYqocFhAflPqRtVhiHcLfGC2htTtML8H:WmPOoY7lxBA8+tqXH0lPS8gGC2ztj
TLSH 1045F18476A4B7DEC4ABD3B19A241C2463B03C679213D107BC4B71DE5BBEB818F25993
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lucky1.263xmail.com
Sending IP: 211.157.147.135
From: 上海雅众 <yzysh@yzybj.com>
Subject: Fw:RE: FW: 1x20'GP payment euro 10,000 / AMY【Suspected phishing email, please pay attention to password security】
Attachment: Re_Fwd Payment.img (contains "Re_Fwd Payment.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b137b1fbdf2b830a6f9efa754e4db3fa26fa1eb1c46d4fed1b6e02887f673cb5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 07:29:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=we33d667fobqu3467j2u4tnt7itpuhvryrwu73i3nybiq73hhs2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img b137b1fbdf2b830a6f9efa754e4db3fa26fa1eb1c46d4fed1b6e02887f673cb5

(this sample)

AgentTesla

Executable exe ead8bad9a2efd5b260c0f71472f096001a27bfb1a1b853d8309c22f6a157e75a

  
Dropping
MD5 b978a8074bc3a57e369bbe5a252cef55
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ead8bad9a2efd5b260c0f71472f096001a27bfb1a1b853d8309c22f6a157e75a

Comments