MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18fbe37d773f6459324cdc102cdad0a0266f2e72c62060bf1930aa733a171382. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18fbe37d773f6459324cdc102cdad0a0266f2e72c62060bf1930aa733a171382
SHA3-384 hash: a367a3e8dc2f94ba425c6e3f15e22ce2b5c3aa97e858437c1d89d7d772b5de4ebcf39d8712a3beacfe67e06a95ce37f1
SHA1 hash: 3b884d7eb7f07cc6228b9fef4fa0a9fa74b94b31
MD5 hash: 721926f5bd435d9ec123b4fbbe1d7e31
humanhash: arizona-don-connecticut-four
File name:PO-0075930-1.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-13 05:41:42 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:EwN+JFLmAJGG6L1IVMgdE9wzTXoDYOR9bW10XXz:EwgvL/IGxXXQR9bW10X
TLSH EC4548157A86C0B2E01818767500E7AE9314BC38D4178D43B6967FDFFBF0ADA4E16A36
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ct13632.vservers.es
Sending IP: 188.164.194.49
From: Al Shidhany <alshidhany@multitrade.com>
Subject: Purchase Order: PO-0075930-1
Attachment: PO-0075930-1.IMG (contains "PO-0075930-1.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Heur2.FUL.MuW@aC4qfQfi.26805.19855.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18fbe37d773f6459324cdc102cdad0a0266f2e72c62060bf1930aa733a171382/
Threat name:
Win32.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 05:43:04 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dd56g7lxh5sfsmsm3qiczwwquatg6ltsyyqgbpyzgcvhgoqxcoba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18fbe37d773f6459324cdc102cdad0a0266f2e72c62060bf1930aa733a171382

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 18fbe37d773f6459324cdc102cdad0a0266f2e72c62060bf1930aa733a171382

(this sample)

AgentTesla

Executable exe 6fefda6e593a6be7de5636905b89eef16e82b904e95bf88245ee067b84cebbed

  
Dropping
MD5 47c6929f165ab4a4163ab5102f92d4b3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fefda6e593a6be7de5636905b89eef16e82b904e95bf88245ee067b84cebbed

Comments