MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35aa4644b715101d5d6fef17b5eeefc6e0188c7f75a68f8c6a24a89c398a7563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35aa4644b715101d5d6fef17b5eeefc6e0188c7f75a68f8c6a24a89c398a7563
SHA3-384 hash: 27edefcb0f1e9f7ae01ec0f43738e7c740037e82f0655b4e0a5717f971020105965878a9d95cdc536a0ac598e37d50f5
SHA1 hash: 340d0b40c8fc97b226c47f6535a63cf7a6ececbd
MD5 hash: 108148e4ccb858b9fe941dd68d21fb3a
humanhash: delta-red-tennessee-three
File name:December Order Shipment.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:219'136 bytes
First seen:2020-11-03 09:50:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:csNjoSNuSWc56hjd+7leniOcGMyovzuczl9ixgC1ulwHSMVly3dplLOXonTJ7xqV:JjjFWvm9ixpUuHd7mzlLOXs/GKrHz8
TLSH 5D24F8A460AAD411F51B4435E2A9BEF001B3BD87CAD51E17736CFD213BFA7823A0564E
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Gao Jun <june.gao@gentherm.com>"
Received: "from postfix-inbound-15.inbound.mailchannels.net (inbound-egress-3.mailchannels.net [34.214.167.131]) "
Date: "3 Nov 2020 01:47:11 -0800"
Subject: "December Order Shipment"
Attachment: "December Order Shipment.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.2f3446e4cfbd31cf.27561.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35aa4644b715101d5d6fef17b5eeefc6e0188c7f75a68f8c6a24a89c398a7563/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 09:52:06 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwvemrfxcuib2xlp54l3l3xpy3qbrdd7owti7ddkesujyomkovrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/35aa4644b715101d5d6fef17b5eeefc6e0188c7f75a68f8c6a24a89c398a7563

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 35aa4644b715101d5d6fef17b5eeefc6e0188c7f75a68f8c6a24a89c398a7563

(this sample)

AgentTesla

Executable exe 61a82a7cb29365a6ece69b6cdf60f03abec86782ede46e9d3908f122b2e251a5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61a82a7cb29365a6ece69b6cdf60f03abec86782ede46e9d3908f122b2e251a5
  
Dropping
AgentTesla

Comments