MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc3c84922c4e754976892b919daadec28c5f390e767ccec99775c4e26eeb5bb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc3c84922c4e754976892b919daadec28c5f390e767ccec99775c4e26eeb5bb8
SHA3-384 hash: 562386b21a3f4ba79f1f44600237ebedda3582ba273f5aae07e0e90a43a92ea0660f93d30e60b0b155d693ffe17878c2
SHA1 hash: d7e591bccdd03d39cbb5da016a54f67f6c4ebcaa
MD5 hash: c88676eec728fd3ad8d24572ecc5ade2
humanhash: oscar-jupiter-utah-ohio
File name:INVOICE.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-08-14 08:10:37 UTC
Last seen:2020-08-14 08:11:15 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:q7pAtqydLmhFSm0rPryNMJwXKkQ33DgYW3ikOulP:q2jdKCJEK3JWykOWP
TLSH D1559E66F2E04833C17616389D1B57749D2EFE102A24AD863FE97D4C9F39EC139252A3
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 37.48.85.240
From: Komossera <rud-division@alkuhaimi.com>
Subject: INVOICE N ° 014/08/2020
Attachment: INVOICE.IMG (contains "shedy.exe")

AgentTesla SMTP exfil server:
mail.myvfxpro.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200814-0305.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc3c84922c4e754976892b919daadec28c5f390e767ccec99775c4e26eeb5bb8/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:12:06 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3q6ijermjz2us5ujfoiz3kw6ykgf6oiooz6m5smxoxcoe3xllo4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dc3c84922c4e754976892b919daadec28c5f390e767ccec99775c4e26eeb5bb8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img dc3c84922c4e754976892b919daadec28c5f390e767ccec99775c4e26eeb5bb8

(this sample)

AgentTesla

Executable exe 659cae123fddea653c5ca19e452e809bedb01e283b442dff20f0f5e674a35b1c

  
Dropping
MD5 5277d5a5515ef72c426b650ede2c95f8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 659cae123fddea653c5ca19e452e809bedb01e283b442dff20f0f5e674a35b1c

Comments