MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18e07cecf13a3287a98379548f32e128b84a9c9f3e81116bfe21fb1116b60e33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18e07cecf13a3287a98379548f32e128b84a9c9f3e81116bfe21fb1116b60e33
SHA3-384 hash: 4de7b2e4e5a08d931336c7014c5d98a7820b8d31b2e7f1fc4321c9c3084f6f6d16ab994f50c595cda8ed985ae1ad1120
SHA1 hash: e5410aa611f39c57b0410bf44f739738263b8d50
MD5 hash: 9f09f0ed543521f99c98e8e411ec5d22
humanhash: black-kitten-don-oscar
File name:IMG-358998653456780987354609-45876556.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-19 07:22:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:smARKftlbPTtfDuu755dhg0YXAqd9F56FVJS0ZGmOdnDU4EzHoH:smAgjbPhy21hgnlNgFVAXbJDLEK
TLSH 9645E105E285BBD8C35805779AA1D0290550FD748F2BC049FB9C7622BBB07CBA9E6D37
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ct13632.vservers.es
Sending IP: 188.164.194.49
From: cuentas <cuentas@frutasyverdurasbernimabel.com>
Subject: Re: Confirmación de aviso de pago
Attachment: IMG-358998653456780987354609-45876556.IMG (contains "IMG-358998653456780987354609-45876556.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18e07cecf13a3287a98379548f32e128b84a9c9f3e81116bfe21fb1116b60e33/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 10:27:26 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddqhz3hrhizipkmdpfki6mxbfc4evhe7h2arc276eh5rcfvwbyzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
TeslaCrypt
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18e07cecf13a3287a98379548f32e128b84a9c9f3e81116bfe21fb1116b60e33

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 18e07cecf13a3287a98379548f32e128b84a9c9f3e81116bfe21fb1116b60e33

(this sample)

AgentTesla

Executable exe 8433ac6d87185d65251a833f4f37ac4095395d2751da1ff95e8d9d4e53656480

  
Dropping
MD5 25489394a1f1c4d620185db426187edf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8433ac6d87185d65251a833f4f37ac4095395d2751da1ff95e8d9d4e53656480

Comments