MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff78c9375a234f27e9697574ee57a7b3fbe725e3ac570771db2a8703ec4ab97b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff78c9375a234f27e9697574ee57a7b3fbe725e3ac570771db2a8703ec4ab97b
SHA3-384 hash: 8785464675794a19737d1bb10da33f05cf1f870ef92385573bb1094daf432f52c8881bf340523c53b2b0bd2b57d9e6a3
SHA1 hash: 068213dffc7686c67bfd6480438dc5daf1598610
MD5 hash: f19c7339ba883468e1c987729e03347c
humanhash: item-connecticut-grey-bakerloo
File name:pay invoice.scr.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-29 19:32:08 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:1awR1A7W5XniZThDuEf6Ld7vxhkGGrQnvhQueZ:meni10EyLNvdGkj
TLSH 4E4512799BAC3A3EC21B06FC84C19D0572A9C169F613F3967D8E115D839EBC12D64E83
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mta01.svc.cra.dublin.eircom.net
Sending IP: 159.134.118.222
From: Philip Hollingsworth <pjhollingsworth@eircom.net>
Subject: Re: Balance Outstanding payment invoice Per Diem USJ003600 JBPW DEADLINE: $39,975.00
Attachment: pay invoice.scr.img (contains "pay invoice.scr.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis077EE2A6320F.17508.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 00:23:10 UTC
File Type:
Binary (Archive)
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=754msn22enhsp2ljov2o4v5hwp56ojpdvrlqo4o3fkdqh3ckxf5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ff78c9375a234f27e9697574ee57a7b3fbe725e3ac570771db2a8703ec4ab97b

(this sample)

AgentTesla

Executable exe 5a06f053014f58149aaff3aef789579d02ee6e1881e89311320dc0df3ae1d674

  
Dropping
MD5 077ee2a6320fd17e1a49845feceb19b4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5a06f053014f58149aaff3aef789579d02ee6e1881e89311320dc0df3ae1d674

Comments