MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19bd376d4febdfc512a5e1242c79a9a0e2b77c007a09ae07b05a656957a42618. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19bd376d4febdfc512a5e1242c79a9a0e2b77c007a09ae07b05a656957a42618
SHA3-384 hash: 82cf76bbf1a4146ec4992e0da13e8e2adb80fc0b8e1274d758baf07f3924256329a7664c218380fb2700a5900599ec72
SHA1 hash: dae91b6a5431d0daf8fc578477df10c2812bb9f2
MD5 hash: 101543f1806d201c652031dab1181b94
humanhash: equal-cup-whiskey-comet
File name:Purchase Order.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:677'888 bytes
First seen:2020-08-31 10:17:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:0tRfaZt38zRoWyjswBQuURmx7qlP4fBnTpKFpQ/MGCuqnE2OlFqjmu:MRfY38NoWyjJN7qlP4fBnTpKsMG3Fqjm
TLSH 11E41252A76DCB97E5F906BA881E711053273D91C5B0D60ABC8DB89B3BB37508122F4F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host13.registrar-servers.com
Sending IP: 198.54.126.53
From: info@securedservices.xyz
Subject: Quotation Request
Attachment: Purchase Order.img (contains "Purchase Order.exe")

AgentTesla C2:
http://securedservices.xyz/webpanel/inc/e4473c63d03b48.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19bd376d4febdfc512a5e1242c79a9a0e2b77c007a09ae07b05a656957a42618/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dg6to3kp5pp4kevf4escy6njudrlo7aapie24b5qljswsv5eeyma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/19bd376d4febdfc512a5e1242c79a9a0e2b77c007a09ae07b05a656957a42618

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 19bd376d4febdfc512a5e1242c79a9a0e2b77c007a09ae07b05a656957a42618

(this sample)

AgentTesla

Executable exe 7a53181aa1e3f435bf2036ddff15a7e8e3382bfceade53abd9f3a6e14ed2cf5b

  
Dropping
MD5 8b622390bd7c3a881878b740857c506b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a53181aa1e3f435bf2036ddff15a7e8e3382bfceade53abd9f3a6e14ed2cf5b

Comments