MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 374b19abf86b2c509b3a568813772f9ea2948be7a9f95a9e621f6fb941689a9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 374b19abf86b2c509b3a568813772f9ea2948be7a9f95a9e621f6fb941689a9b
SHA3-384 hash: d16332fb5145f101fd2196632e6904dfb495d0753d4900e3546543319a50b8ae6d8175c4922b2b2f810346fbc171a3f4
SHA1 hash: f5bb3401e844f430f27dbe4482e037c57686dbbe
MD5 hash: edd245a244fcc9dd82e6b8c01c72d68e
humanhash: carolina-oxygen-solar-march
File name:order 11082020.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-08-11 13:58:37 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:dVUlfCYxjD3yCfUR8rjYw9+2LEMNkw8Ri/mZ:4pZxjLRfi8rcwQ2ZikmZ
TLSH 5B55DF2572D5D80CC2A91536CE8B8308077AAC462532C5D93ADB337DAE3D3FB9B1568D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: James Liu <info@superbheater.com>
Reply-To: info@superbheater.com
Subject: order list_#11082020
Attachment: order 11082020.img (contains "order #11082020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FYE8312363A07AC.14862.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/374b19abf86b2c509b3a568813772f9ea2948be7a9f95a9e621f6fb941689a9b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:00:12 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5frtk7ynmwfbgz2k2ebg5zpt2rjjc7hvh4vvhtcd5x3sqlitknq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/374b19abf86b2c509b3a568813772f9ea2948be7a9f95a9e621f6fb941689a9b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 374b19abf86b2c509b3a568813772f9ea2948be7a9f95a9e621f6fb941689a9b

(this sample)

AgentTesla

Executable exe 19a180b5e3696a27292810125957efca24a09e7743d951e5386bd69daaca8dfe

  
Dropping
MD5 8312363a07acf970b5d69162c20b7393
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 19a180b5e3696a27292810125957efca24a09e7743d951e5386bd69daaca8dfe

Comments