MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 274deaa2618e1a01b49f9e66ca7c67cba4b113b8ceceaa8eef14649ce31c835a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 274deaa2618e1a01b49f9e66ca7c67cba4b113b8ceceaa8eef14649ce31c835a
SHA3-384 hash: 1380eed63c7252735b28fad1e9465f0a236d95d1374110c6b51fae51e2f283a0f878d384a321c26774c8f5a50ccea002
SHA1 hash: cae3fb4b8a464218059d5ac52f6c8c1c39b9be20
MD5 hash: f43072bcab7564abed4ee59e74cee9fd
humanhash: summer-sixteen-nevada-charlie
File name:purchase_order_900000.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'523'136 bytes
First seen:2020-06-03 08:24:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:1aUDdA6VEt6A/OZUmxNimXDlKFLIbsL1swv91SrSlPq2Jwz38ON:pq6N+O6ibql1swHC2eQG
TLSH CFC52E27EC059647E02C83FDE40B1DB4A62E1745F583ABFE20BA0E8E6E111476E9717D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.engrafik.com
Sending IP: 79.98.129.253
From: Outix Australia Pty Ltd <info@outix.com.au>
Reply-To: duward54@ifavorsprt.com
Subject: Re:Re: Order 9000
Attachment: purchase_order_900000.img (contains "purchase_order_900000_img.exe")

AgentTesla FTP exfil server:
ftp.behnazgroup.ir:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 00:46:00 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5g6vitbrynadne7tztmu7dhzoslce5yz3hkvdxpcrsjzyy4qnna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 274deaa2618e1a01b49f9e66ca7c67cba4b113b8ceceaa8eef14649ce31c835a

(this sample)

AgentTesla

Executable exe 1131ab88a34e407885402ad2d4754fe78d93ba18e232f5fbd9c55abd3644eee2

  
Dropping
MD5 391ed871156a8ad81a2b5015a3938ed9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1131ab88a34e407885402ad2d4754fe78d93ba18e232f5fbd9c55abd3644eee2

Comments