MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d78fdaaa7d417e49c814f47d2f0517dd60123fb1b6982006b512d1499982f334. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d78fdaaa7d417e49c814f47d2f0517dd60123fb1b6982006b512d1499982f334
SHA3-384 hash: 8e99382de9d1610dcfa5f15a1ebb4b99fe11a7fdfb91a2988db3c2332857888b54340ae194252569853da2e6b4f69379
SHA1 hash: c12f2641d0740d894d50c9e2959ab39baa58133b
MD5 hash: ae78dfb47e6ddb38ee1dc7ca1cc7de88
humanhash: cat-quebec-white-twenty
File name:6878786Order6789.xlsx.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'277'952 bytes
First seen:2020-06-26 08:03:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:8asP6jq6giueRB5ojFI4stSrhbPz+XVjoioBkrdgPHRK:qp6gPOTLS8XVj/oBkSPHRK
TLSH 1C455A2D7A85B805D13C0A7241DA59956372DA837702C30F7DCAA76CAF623DF3B0629D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: chudaii.mooo.com
Sending IP: 5.206.227.2
From: Zlata <pupojqlwxltnqzynhgqwkv@leefurnitures.com>
Subject: RE: New inquiry-10959241272008-leefurnitures Co.,Ltd
Attachment: 6878786Order6789.xlsx.img (contains "4658576745Order876578.exe")

AgentTesla SMTP exfil server:
smtp.mail.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.349.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d78fdaaa7d417e49c814f47d2f0517dd60123fb1b6982006b512d1499982f334/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 08:05:05 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=26h5vkt5if7etsau6r6s6bix3vqbep5rw2mcabvvcliutgmc6m2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d78fdaaa7d417e49c814f47d2f0517dd60123fb1b6982006b512d1499982f334

(this sample)

AgentTesla

Executable exe b2dd74f222dc86e21c6843422c56a9beb1410a5a578817e76b7c8b036ebc9d09

  
Dropping
MD5 a8ef3cc111484672cb722df16622f550
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2dd74f222dc86e21c6843422c56a9beb1410a5a578817e76b7c8b036ebc9d09

Comments