MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c038179d69e85163433807e557740bdcb729c68b6cf27fe6bd7838279dcf615d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c038179d69e85163433807e557740bdcb729c68b6cf27fe6bd7838279dcf615d
SHA3-384 hash: fc9fef2035961c26640617d7e2848886ab7f324f66359c437660258a2fe6f96761ba54a15644b87e276cd629eabfd875
SHA1 hash: 12fa2dbb7944366cc80b0dd30e930f2df76821b4
MD5 hash: bca369d104022899fea1fceef2e15ba3
humanhash: september-july-steak-purple
File name:Image002.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'703'936 bytes
First seen:2020-08-05 08:33:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:WeXPHJ6V6WfKmIE5AUe71kzgTctpwKpw:WeXPK6WymIEyUQegTctpRp
TLSH 7F75E0B13A48CF64E87E073134376840EBF2BD05DB60E60EFD9971AD1B726894E16B19
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: msa-smtp12.hinet.net
Sending IP: 168.95.6.62
From: info@moldeid.com
Subject: Statement up to 4 Aug 2020
Attachment: Image002.img (contains "Image002.exe")

AgentTesla SMTP exfil server:
smtp.blackpyramid.xyz:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c038179d69e85163433807e557740bdcb729c68b6cf27fe6bd7838279dcf615d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 01:52:01 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ya4bphlj5biwgqzya7svo5al3s3strulntzh7zv5pa4cphopmfoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c038179d69e85163433807e557740bdcb729c68b6cf27fe6bd7838279dcf615d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c038179d69e85163433807e557740bdcb729c68b6cf27fe6bd7838279dcf615d

(this sample)

AgentTesla

Executable exe 10692decc0eaae1268c4d9474ea22d190dc1cc5dd000b5bc03b8daad5baade1c

  
Dropping
MD5 53ef27be1e84245a312ded140999b0a1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10692decc0eaae1268c4d9474ea22d190dc1cc5dd000b5bc03b8daad5baade1c

Comments