MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8a22bb98e8c4252e78826c7941dccaa957e39f9f958d59b1d2cee4f6ca30d31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8a22bb98e8c4252e78826c7941dccaa957e39f9f958d59b1d2cee4f6ca30d31
SHA3-384 hash: 786e50d4c0773091706ddde2d4f2516dd2a8e108d7680309db66a4fb8b65238a2d8cdf4d6794b08d086c751a1f5f1c9d
SHA1 hash: 50050e0ae19f7c0c9d2631fb08624c71adb15a86
MD5 hash: a05ce7dd5c0be7827b03e1dffa0f1df3
humanhash: wyoming-idaho-shade-india
File name:MT0234PO.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'359'296 bytes
First seen:2020-05-05 10:55:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:Etb20pkaCqT5TBWgNQ7ahgLhEDd3nz7g/TzhwyGxilxPZMMvIey/cT6A:tVg5tQ7ahgLW3g/X5W0PVAeoG5
TLSH 86B5DF22639D8260C76F51737A557701AE7BA8153761FCFB2FA8083CA9101E11E3E66F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.212
From: Dae-Jun Kim <ref@intertach-group.com>
Subject: Re: Order
Attachment: MT0234PO.IMG (contains "2020eed.exe")

AgentTesla SMTP exfil server:
smtp.ay0ub-sd.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:04:53 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3crcxomorrbffz4ie3dzihomvkkx4opz7fmnlgy5ftxe63fdbuyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d8a22bb98e8c4252e78826c7941dccaa957e39f9f958d59b1d2cee4f6ca30d31

(this sample)

AgentTesla

Executable exe cf7fa6c522942e6b4c87248e59e239bb3e265cf9f138c9821e538f3e182f5fa3

  
Dropping
MD5 d12db96741e1c6e4c428b272caaccbfc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf7fa6c522942e6b4c87248e59e239bb3e265cf9f138c9821e538f3e182f5fa3

Comments