MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e83f438494f2a173e3c178cd23398577fdfffd2f2315b97029ccc5025af38370. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e83f438494f2a173e3c178cd23398577fdfffd2f2315b97029ccc5025af38370
SHA3-384 hash: 0881845accae7fc4f08129d38ff181cb5583bdd44d54a6d709aab83b327a789cc562697e50c10bccabcd241c054c7440
SHA1 hash: 6c0661ea4e482980e0689b8cf0fd3c31ebece477
MD5 hash: 63e7285817e88126790f64830e4c2b92
humanhash: one-magazine-dakota-leopard
File name:RFQ#5471-12962020.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-06-12 08:32:02 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:HNwpLEFOgIaBqFUFVAwu/i49VR4S0L/3G2mDn6iz14:Y0OgupiiYGxDb4
TLSH A155BFD182894665E94E8F3484B14C6466F7DFABBE6DF34AEC4874A51B333E2E027407
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv2.trendstudio.it
Sending IP: 62.116.182.204
From: Isabella <instituto@iaci.es>
Subject: RFQ#5471-06122020-Urgente
Attachment: RFQ#5471-12962020.IMG (contains "RFQ#5471-12962020.scr")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.SRE.12195.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 08:33:07 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5a7uhbeu6kqxhy6bpdgsgomfo76777jpemk3s4bjztcqewxtqnya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img e83f438494f2a173e3c178cd23398577fdfffd2f2315b97029ccc5025af38370

(this sample)

AgentTesla

Executable exe e070c9b84487dcd9290a34f999f51202c1ab7810bbe060a9817d437c9a7840f2

  
Dropping
MD5 a191f8360b06414209e5d4e83239113c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e070c9b84487dcd9290a34f999f51202c1ab7810bbe060a9817d437c9a7840f2

Comments