MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5dba6b6b379abd9ed83a21db9eedc53de799e9285d26231c7b9f7d315b1caaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5dba6b6b379abd9ed83a21db9eedc53de799e9285d26231c7b9f7d315b1caaf
SHA3-384 hash: 891c538e19ded9bb4a7e058e063ae93482f80a99a0101ac29126b27d781776986a34022dad8f1bcc23a4b7bf980a1a92
SHA1 hash: 991ea8e53bf93e6321afdba146c808c9792579a6
MD5 hash: 61d584f94464d49551ae85e9abcfab43
humanhash: oranges-arkansas-pip-nine
File name:20200809.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-10 13:51:22 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:mWGxLfrxh9+spUAMINywVz83PAZILlQXFhUhAse5repP:mWGxjrxz2INywVz84ZdFyAfrep
TLSH E245D0623148AB73E42DAB7D8235632413FBBC19F736C6067F8E53D916A2F348B60951
Reporter abuse_ch
Tags:AgentTesla img Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic312-47.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.128.109
From: Mira Jane Williams <mirajnwilliams@yahoo.com>
Subject: OUTSTANDING INVOICE
Attachment: 20200809.IMG (contains "20200809.exe")

AgentTesla SMTP exfil server:
smtp.epak-de.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.6163.4344.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5dba6b6b379abd9ed83a21db9eedc53de799e9285d26231c7b9f7d315b1caaf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 13:53:05 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xn2nnvtpgv5t3mduio3t3w4kpphthusqxjgemohxh35gfnrzkxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d5dba6b6b379abd9ed83a21db9eedc53de799e9285d26231c7b9f7d315b1caaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d5dba6b6b379abd9ed83a21db9eedc53de799e9285d26231c7b9f7d315b1caaf

(this sample)

AgentTesla

Executable exe aac7836cc3621b697210ec64dc5d423c1537bcc8e1e1276e8b0b9f8367251197

  
Dropping
MD5 70cf5740b78c1dff710d3883c448640a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aac7836cc3621b697210ec64dc5d423c1537bcc8e1e1276e8b0b9f8367251197

Comments