MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df844fd2bd99b7da5d1871c4f4009ab10c74b83af48f605f61518b454814f99a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df844fd2bd99b7da5d1871c4f4009ab10c74b83af48f605f61518b454814f99a
SHA3-384 hash: 6db00cf3fad3e52c41734b47350e953bde16a8766ded7e4b90f648809c310f37321e4ebb89012f39c4e2fd53109a0640
SHA1 hash: b83a4b728c4fbbc981e144b50c901ee22e9b1045
MD5 hash: 03c82d8559f56beedcfed82a51f98872
humanhash: mobile-dakota-sad-september
File name:MT023PO.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'424'832 bytes
First seen:2020-05-05 10:07:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:ktb20pkaCqT5TBWgNQ7amydcv+JcPr7QlMOgOHw16HVW7YkUmmhA6A:NVg5tQ7amydcacPr7QlMORXIhmK5
TLSH CFB5E01223DD8260C3BD51737A557701AE7BF82906A1F4FB2FB8C93DA9201215E1E66F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.212
From: Dae-Jun Kim <ref@intertach-group.com>
Subject: Re: Order
Attachment: MT023PO.IMG (contains "MT023POe.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:36:37 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=36ce7uv5tg35uxiyohcpiae2weghjob26shwax3bkgfuksau7gna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img df844fd2bd99b7da5d1871c4f4009ab10c74b83af48f605f61518b454814f99a

(this sample)

AgentTesla

Executable exe fa0ac43dbbc556f1f34ec4a98447596ac837034c10edaddc8e4dfb0549b508be

  
Dropping
MD5 da629ab292b78a386d9a66f17e2d26e9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa0ac43dbbc556f1f34ec4a98447596ac837034c10edaddc8e4dfb0549b508be

Comments