MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0dff210f8c759c52bea75aaae8b8c2b3c830f65b354ddfb12537133bdb32adc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0dff210f8c759c52bea75aaae8b8c2b3c830f65b354ddfb12537133bdb32adc
SHA3-384 hash: a9468959b1f174b2f429fe36b61f21d7481d3f95d3be613c46c2216e189cc1395bd7597d4d95b2fdb48db93fe622092d
SHA1 hash: 77ea9339f3265de30341cc489d9990f15720fd51
MD5 hash: 48dc0b86a040ca7beeaeb7b25376bb5c
humanhash: jupiter-nineteen-berlin-xray
File name:Payment copy_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-24 15:59:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:QVDSbXJFl+yQ5Fm5YHxNgNIAmByw664QHc:QVDSbX94FpHxuNINvn4Yc
TLSH E24512587BA0A72EF62E07F2A5A0622853F17071295AC2097DCE30CD572FF818650FE7
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp2.africa-online.net
Sending IP: 41.190.93.230
From: elnhab <reservations@ufulugardens.mw>
Reply-To: elnhab@yahoo.co.jp <elnhab@yahoo.co.jp>
Subject: Payment Confirmation (Mt103)
Attachment: Payment copy_pdf.img (contains "Payment copy_pdf.exe")

AgentTesla SMTP exfil server:
prudential.com.np:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ELBN.26016.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 16:35:32 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f0dff210f8c759c52bea75aaae8b8c2b3c830f65b354ddfb12537133bdb32adc

(this sample)

AgentTesla

Executable exe 22fd870db6109516f3696a5a25e7aa26a00fb233ee537de7403818514d2671fa

  
Dropping
MD5 dac2e135d82d0a829efa9d9d7e470e20
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22fd870db6109516f3696a5a25e7aa26a00fb233ee537de7403818514d2671fa

Comments