MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f485ecf0bf6a6f3a128e0730f9d7f6bbe5c3a3d8f973fcf958b881cc2cffff0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f485ecf0bf6a6f3a128e0730f9d7f6bbe5c3a3d8f973fcf958b881cc2cffff0
SHA3-384 hash: 12da9de8fe53e6aca7e9c3a2b3b03be0b88c52557427d6cd8f0d3c2a3c1a03689425db0449090eed6c577c67cd950e1c
SHA1 hash: d1199a1142b306ce7b6c25c94f4d4d5f68affdf8
MD5 hash: 5efb31a29d32b306dfb089a6690ba18c
humanhash: jupiter-nineteen-august-mexico
File name:PO_CONSUMMABLES_8899_1129_9928_9090PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:892'928 bytes
First seen:2020-07-08 07:09:08 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:EaXAU+xBGmhys2qujwVBXcjslhtWEslhtWW:fAU+emhyDi/sWhtWphtW
TLSH 3E15BD3B2766BE8FC63A0DF5909601104FFA18D37249D3F8ADC754FA88D5B848F56262
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.macartajans.com
Sending IP: 89.252.130.69
From: Cristian Rodrigo Valdebenito Riffo <cvaldebenito@csh.cl>
Subject: Purchase Order_Consummables
Attachment: PO_CONSUMMABLES_8899_1129_9928_9090PDF.IMG (contains "PO_CONSUMMABLES_8899_1129_9928_9090.exe")

AgentTesla SMTP exfil server:
smtp.knmbz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f485ecf0bf6a6f3a128e0730f9d7f6bbe5c3a3d8f973fcf958b881cc2cffff0/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 07:11:04 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5ef5tyl62tphiji4bzq7hl7no7fyor5r6lt7t4vroebzqwp77ya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 1f485ecf0bf6a6f3a128e0730f9d7f6bbe5c3a3d8f973fcf958b881cc2cffff0

(this sample)

AgentTesla

Executable exe 77cae929decac2069a213256e01ab18f1ccae29a3fee73fb501991b419507e42

  
Dropping
MD5 b0c215630c1ed900a1d2e6aedd97cbbb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77cae929decac2069a213256e01ab18f1ccae29a3fee73fb501991b419507e42

Comments