MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 394294f9fcb50ba10b9791c8e3ff05ad26e36f86558db8876d0773ad3ed24192. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 394294f9fcb50ba10b9791c8e3ff05ad26e36f86558db8876d0773ad3ed24192
SHA3-384 hash: 5b82e213bce4a219ce517789a27d07be04608b98c46d600dd997f8e3809c2f2c5b8dbc85eca8c594d2dc7b6285ab25d2
SHA1 hash: 16dd7d592d6434e42bd3c5be3eef684d56b3f17a
MD5 hash: 7345ba49e8595d8c926977a17172cedd
humanhash: william-kilo-snake-minnesota
File name:New Order-21.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'638'400 bytes
First seen:2020-12-07 07:41:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:o6O6ovaeodqIU1dUMCnJta5TRee/nBhm01tST0sDdL:o6O6WaeoCKAdPB401oT0Ad
TLSH EB75AE399E945039F4726F7C88A02555665E7F937F1BE89D2CB532EA0B37AC289C013C
Reporter cocaman
Tags:img


Avatar
cocaman
Malicious email (T1566.001)
From: "Costco Wholesale<richard.chang1@costco.com>" (likely spoofed)
Received: "from costco.com (unknown [216.108.231.160]) "
Date: "06 Dec 2020 22:41:26 -0800"
Subject: "Re: Costco New Order "
Attachment: "New Order-21.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2229.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/394294f9fcb50ba10b9791c8e3ff05ad26e36f86558db8876d0773ad3ed24192/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-07 07:42:06 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfbjj6p4wuf2cc4xsheoh7yfvutog34gkwg3rb3na5z22pwsigja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/394294f9fcb50ba10b9791c8e3ff05ad26e36f86558db8876d0773ad3ed24192

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 394294f9fcb50ba10b9791c8e3ff05ad26e36f86558db8876d0773ad3ed24192

(this sample)

AgentTesla

Executable exe c9ebd1426e4e2da4c74d6a9ef667858b3be5070d792112ce4ee5e7fdc3c9ff9c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9ebd1426e4e2da4c74d6a9ef667858b3be5070d792112ce4ee5e7fdc3c9ff9c

Comments