MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8bdf8f1709475b1889ab0abdabbbaa90503975d07b02b49ad61bd7739bdc1a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8bdf8f1709475b1889ab0abdabbbaa90503975d07b02b49ad61bd7739bdc1a7
SHA3-384 hash: 8a07ec7099cc4fbea58bbc494cd3a9f0e4ac4d043689c4e6ee6fd3c70928b07256647735d7784bcb37a40533f63bd074
SHA1 hash: 8add18c12badef58f70795d3cf1c4347505e7b8c
MD5 hash: 84352835caa5f362f118cf79641101db
humanhash: helium-lithium-bluebird-two
File name:MT024PO.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'162'688 bytes
First seen:2020-05-11 14:25:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:itb20pkaCqT5TBWgNQ7aOWNK3ZbgB22/DAPqy0A9rlIeXVLlrSb6A:vVg5tQ7aOWNYZIz/DGqy/3rXg5
TLSH 71A5D01263DD8360C77E5273BA157701AEBB782506A5F4BB2FB8093CA9101E14E1E76F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.212
From: Jun Kim <ref@intertach-group.com>
Subject: Re: Order
Attachment: MT024PO.IMG (contains "MT024PO.exe")

AgentTesla SMTP exfil server:
smtp.ay0ub-sd.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 04:26:41 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zc67r4lqsr23dce2wcv5vo52vecqhf25a6ycwsnnmg6xoon5ygtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c8bdf8f1709475b1889ab0abdabbbaa90503975d07b02b49ad61bd7739bdc1a7

(this sample)

AgentTesla

Executable exe 8bd06e8a541a1498bc8a2d44d2212d369214a9cd29bbdb7b802d01e4c1c3fc1f

  
Dropping
MD5 12fce56ad3b4e817b821b42d09e5c113
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8bd06e8a541a1498bc8a2d44d2212d369214a9cd29bbdb7b802d01e4c1c3fc1f

Comments