MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1fe6496c38814408214fd4311fb703d96d808cae92c876536b9325657cad15c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1fe6496c38814408214fd4311fb703d96d808cae92c876536b9325657cad15c
SHA3-384 hash: 0a743e3932b97683fc46d5b68cc4f3ec95da6105c3d948d098e8121455df1263c812f953166c28594dfab01f2075dc67
SHA1 hash: 207054d3ed030e52ea9397898d1c33e091f8e1dc
MD5 hash: ff82d0a4e322ca4a8f03f07c6b818aae
humanhash: seven-mobile-papa-xray
File name:Payment transfer details_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-03 08:54:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:M5Ra2z74aXV9C9QgqsNBdpv4Qq8aY6cheR1Ph4YBX81zaz1yMouo9/ScyueoZ5Nj:MnaKk8btgqApPmRJBs9CyMSyueaNv7
TLSH 9645F1153A547D17CAFC88F9D0B2215587F68226269BFBC6BCCE21D613C2BF00991E97
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.aminopez.com
Sending IP: 204.93.159.23
From: no-reply@hsbcbanking.com
Subject: Inward Payment Notification (MT103)
Attachment: Payment transfer details_pdf.img (contains "Payment transfer details_pdf.exe")

AgentTesla SMTP exfil server:
mail.rbt.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 01:00:00 UTC
AV detection:
12 of 31 (38.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2h7gjfwdrakebaqu7vbrd63qhwlnqcgk5ewiozjwxezfmv6k2foa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d1fe6496c38814408214fd4311fb703d96d808cae92c876536b9325657cad15c

(this sample)

AgentTesla

Executable exe 33dddfd7374ea6d08a46041afeac56f1d8df4680191c682479e4812060fd8733

  
Dropping
MD5 7df5c439d0f15d599c070b68a6cdfab6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 33dddfd7374ea6d08a46041afeac56f1d8df4680191c682479e4812060fd8733

Comments