MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2962abb74647281db997c9aadaf8b06edb2a12fa99d84b6f54959676262653a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2962abb74647281db997c9aadaf8b06edb2a12fa99d84b6f54959676262653a9
SHA3-384 hash: c7cc5afabbd98c23cea58ddff08e1549f583e06896163c9416ee8dec6f89383accbe1e879980b9ea6c9312a00c97c559
SHA1 hash: 29a39d7529c644f4cd40cb46c86c5c36c5417684
MD5 hash: b6ebe715fbf673bf0c86a4ac9c945d1a
humanhash: india-pluto-london-tennessee
File name:H-439 H-402_R200060_E4076R.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-25 13:03:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:C2Zq148Ejvc94vSStfq6e0837XjebfQ/gQn1lzR8yOOOr8UTMfwbwmV2xFOK5+wV:tcgUVWFB8ebfQ/g41kt/Pwmd
TLSH BD45AE22A2E07832C072163D9F5B5678D825BE13393459763BE9DF4D6F3528234EB287
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.dysonservicecentre.co.uk
Sending IP: 104.168.145.71
From: Export Department <admin001@dysonservicecentre.co.uk>
Subject: Request for Quotation
Attachment: H-439 H-402_R200060_E4076R.IMG (contains "shhhhhhh.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader33.46044.27951.15937.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:31:17 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 2962abb74647281db997c9aadaf8b06edb2a12fa99d84b6f54959676262653a9

(this sample)

AgentTesla

Executable exe f7c15b22bb99bfb56eabcd9b8c985c15c5d9ed341303b39362dccb6808a6a498

  
Dropping
MD5 29c7868a0978befc53faeb23552afb9f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f7c15b22bb99bfb56eabcd9b8c985c15c5d9ed341303b39362dccb6808a6a498

Comments