MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13f64ee149065929c8d01418bf6b4bb9142c501fd81e12ed7213cbb596a54061. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13f64ee149065929c8d01418bf6b4bb9142c501fd81e12ed7213cbb596a54061
SHA3-384 hash: e426db4e86100b06b1fa1468561c8635854f8a60d6d7dacdfbc2d882c853da7383ef7ff2ff4318c693317ed63b72a2aa
SHA1 hash: 2d193fa168f71cc7706bf9079b96ddae369013a0
MD5 hash: 31a99f49a1819f99b22d4acf2fb75056
humanhash: lake-delta-foxtrot-august
File name:transferencia.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-08 08:15:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:Rd2Xgh/KyNwzJCkm8Dnt3FjfmS8x7xCNbIbucUD54BMd96tFvNFjPK6giWpiA:AgOCkmqFTmNWIbM59gRFjPK6grpiA
TLSH 0B451269377D6BB6D5D907FD604D72006778AC066283D72A3E5E70BA3B63B6006E03C6
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.hessenlogistics.com
Sending IP: 162.222.140.110
From: altainterban@serviciobancomer.com
Subject: Registro de Cuenta Interbancaria en Dólares
Attachment: transferencia.img (contains "transferencia.PDF.bat")

AgentTesla SMTP exfil server:
mail.emifarma.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader34.18893.4737.25510.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13f64ee149065929c8d01418bf6b4bb9142c501fd81e12ed7213cbb596a54061/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:17:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cp3e5ykjazmstsgqcqml622lxekcyua73apbf3lscpf3lfvfibqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13f64ee149065929c8d01418bf6b4bb9142c501fd81e12ed7213cbb596a54061

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 13f64ee149065929c8d01418bf6b4bb9142c501fd81e12ed7213cbb596a54061

(this sample)

AgentTesla

Executable exe d959c6dbba3a0e31b0917f5245b93b3c606fb4b3900a77fab714e9c118ad9ed9

  
Dropping
MD5 23e6658e989dcaddfbc424f0e23bf8cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d959c6dbba3a0e31b0917f5245b93b3c606fb4b3900a77fab714e9c118ad9ed9

Comments