MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b903d12a614b6a4387b0e2d526065813d564a793ecaecb83f4c74d4556b5ad1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b903d12a614b6a4387b0e2d526065813d564a793ecaecb83f4c74d4556b5ad1c
SHA3-384 hash: c5f81f39b89b3e666c21359654c89e7de0ca69c9c10a0b17a31c3eeb3e36a13300d42b6a7d1db82fda6fac38f71a4192
SHA1 hash: 72399ae49fcc82cec9085d821881805a9bc59bc1
MD5 hash: 9e556c73faf3c7b85cfd0cf5e5ed067d
humanhash: fanta-johnny-mobile-jersey
File name:payment _slip_copy.iso.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:982'781 bytes
First seen:2020-06-10 11:22:20 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 24576:GCeTrjSIFfTGsG/DFKEsVjrJX9BWmtoiT9KSe4/M4FN+vrG:YTKIFfTKkEApXLWmZxeE/IDG
TLSH C02533CBBFA4E812D6FA3EC02B41CF6DB00B2A72382465C6314ED1E1654A65CBDC975D
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpanel2.centrin.net.id
Sending IP: 202.146.241.44
From: Janssen Pharmaceutical <info@janbe.jnj.com>
Subject: RE: Wire Confirmation Details/Bank Transfer
Attachment: payment _slip_copy.iso.xz (contains "booy.exe")

AgentTesla SMTP exfil server:
mail.rajalakshmi.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:24:06 UTC
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xeb5cktbjnvehb5q4lksmbsycpkwjj4t5sxmxa7uy5gukvvvvuoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz b903d12a614b6a4387b0e2d526065813d564a793ecaecb83f4c74d4556b5ad1c

(this sample)

AgentTesla

Executable exe 4004e92d628057aa94eda2267826d3a4b15e6a72744d02225bdbc849fe5ce23f

  
Dropping
MD5 486e9d40e3a840bda8cb1821e31c4820
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4004e92d628057aa94eda2267826d3a4b15e6a72744d02225bdbc849fe5ce23f

Comments