MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d56d934e4baec8607c554ea3893f021ea798026bb7d0de607fd82f63a73843f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d56d934e4baec8607c554ea3893f021ea798026bb7d0de607fd82f63a73843f3
SHA3-384 hash: aeec0cdff4bf56aafd86971248ddc5f6b790b7108263f63b4bedd7f16da7bcfc0fe8b8f87c8f736b207a573082f65eda
SHA1 hash: 742fcf6626891d5abd6c0e0c41c11d0d70f6306f
MD5 hash: a0b478c07ba5d7f86ec9d5ab454092cd
humanhash: cola-jupiter-mobile-shade
File name:Invoice.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-06-01 19:57:08 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:hvtoMB+K3094JlS9CaSo7tP8D1YlgjngK0Gaz45GcGRypv6dNn:hF1BE94Ojx8EgjngK0GaWGcZSv
TLSH DD559E22E2A04437D17215F89D3B57B86C29BD13792869466BFBDC7CDF38342392A193
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hu.hurryanti.live
Sending IP: 45.95.171.227
From: saurav@ashapura.com
Reply-To: revfatheranthonypaul@gmail.com
Subject: PROFORMA INVOICE
Attachment: Invoice.img (contains "Invoice.exe")

AgentTesla SMTP exfil server:
mail.bwe-group.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 03:32:00 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2vwzgtslv3ega7cvj2ryspycd2tzqatlw7in4yd73axwhjzyipzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d56d934e4baec8607c554ea3893f021ea798026bb7d0de607fd82f63a73843f3

(this sample)

AgentTesla

Executable exe 8a85bd25443551cb0e6c6efc7e8919cc8a7df0191e6766a2c76c71e9c82fb9af

  
Dropping
MD5 16d0d2b2c7693dbc9d106cd038091b95
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a85bd25443551cb0e6c6efc7e8919cc8a7df0191e6766a2c76c71e9c82fb9af

Comments