MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2ca887eb43d7b35aa257b6406b6291aae18f20aaa01ea212ddc7ca4040545a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2ca887eb43d7b35aa257b6406b6291aae18f20aaa01ea212ddc7ca4040545a9
SHA3-384 hash: 5345cf297162410ff6558c2f7c0bfae61bf6509573375305004ad717b97d6b5a4e7c7c59446e57d8d5ee4c8df6f6d60c
SHA1 hash: fa28b230cfc2c8eac7b53238d0147c9c947f17c7
MD5 hash: ffec161a124621dfb447bc98d1c8ac00
humanhash: arkansas-beer-cup-shade
File name:PO. FSTG-2005007 DOCS_PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-20 10:21:02 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:xBSqCcN/gMjjHnfVS/mnH5P4qrJCvNSu0MomGsUs6fcsXh5C/Br3osvnP:XSbciM3fVDPP8Nw6BWcsXO3osvP
TLSH 43450110B1783B33EA7893F96418695443F67A5B1071E3187CDFA0EF2721BB44AA1E97
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ifegy.net
Sending IP: 62.210.114.5
From: Mr. Shadiman <sharmrend@ifegy.net>
Subject: PO. FSTG-20200017
Attachment: PO. FSTG-2005007 DOCS_PDF.IMG (contains "PO. FSTG-2005007 DOCS_PDF.exe")

AgentTesla SMTP exfil server:
smtp.urban.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52076.22091.4418.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2ca887eb43d7b35aa257b6406b6291aae18f20aaa01ea212ddc7ca4040545a9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 10:22:06 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lfiq7vuhv5tlkrfpnsannrjdkxbr4qkvia6uijn3r6kibafiwuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/f2ca887eb43d7b35aa257b6406b6291aae18f20aaa01ea212ddc7ca4040545a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f2ca887eb43d7b35aa257b6406b6291aae18f20aaa01ea212ddc7ca4040545a9

(this sample)

AgentTesla

Executable exe 1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a

  
Dropping
MD5 9b9299a298cd430f1e542bac8c4ffb57
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a

Comments