MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18cd007045e6d4677d64b2ad12a44619271b4e9a97bb321521d8ce3a7594a764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18cd007045e6d4677d64b2ad12a44619271b4e9a97bb321521d8ce3a7594a764
SHA3-384 hash: 893bf524d9737b46cb2be0f1dfc16ceb1bd21dc4484c0c74232f1ea06d2910e5b780864c8f01f73bdbe85f3cad701129
SHA1 hash: ee2724ce5eeabc272e7e3ed8adfa3fa5d469214e
MD5 hash: 922f2737a355dfab091d7eb5be3187ac
humanhash: quebec-violet-twenty-dakota
File name:PEDIDO N 865.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:727'040 bytes
First seen:2020-08-04 10:13:14 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:mHAgbCa8sGQTFuzRyFqhxGRe9hcRAOG7K/kRR/9s0iaeyUg+ruLS2:mHX8kT0cXyJR/rqg
TLSH DAF408393A439425D93C0A3644E465D2A6B1AD473B21CB0F79CE379C5F3368B3F4626A
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: llsd478-a17.servidoresdns.net
Sending IP: 82.223.190.30
From: Inmaculada Hernandez <info@maquinarialdm.com>
Subject: PEDIDO Nº 865
Attachment: PEDIDO N 865.img (contains "PEDIDO Nº 865.exe")

AgentTesla SMTP exfil server:
mail.infotaxis.tk:587

AgentTesla SMTP exfil email address:
drsmith@infotaxis.tk

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18cd007045e6d4677d64b2ad12a44619271b4e9a97bb321521d8ce3a7594a764/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:15:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddgqa4cf43kgo7lewkwrfjcgdetrwtu2s65tefjb3dhdu5muu5sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/18cd007045e6d4677d64b2ad12a44619271b4e9a97bb321521d8ce3a7594a764

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 18cd007045e6d4677d64b2ad12a44619271b4e9a97bb321521d8ce3a7594a764

(this sample)

AgentTesla

Executable exe 0c92c000cf6c2379961f35355527b1886d053245d90a584d8d7191bcb6ebccb6

  
Dropping
MD5 0034a67d2f8ca4f40c52ec3634805b34
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0c92c000cf6c2379961f35355527b1886d053245d90a584d8d7191bcb6ebccb6

Comments