MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e49d03fa08be12409e1ce789de473f8da38c82dd2cb295696dbe4eff7988261. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e49d03fa08be12409e1ce789de473f8da38c82dd2cb295696dbe4eff7988261
SHA3-384 hash: 380df465a3ce0939efdaf70517c03464d6f2f467eb043cce834d5b5bc651d7ec2166fbef71847bc9f7c15928f853e2e1
SHA1 hash: 5f1fc957c261871789679d8d256e02fedfe214c3
MD5 hash: 00b64543b1203f5fc5914feef213b929
humanhash: lamp-paris-idaho-skylark
File name:INVOICE.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'507'328 bytes
First seen:2021-04-06 08:13:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:pgbFFGBqpJjv0aM+2qKbsOwlXAiRjBtsG580WEa6GchSUrXuGdqetlx5:pgbFIBqpGT+23oOwh8VEabsuGdqulx5
TLSH C165E050A3D596C2E86A13F24CA6B40143BAFCED2523CF592D8A72D6523274D0DF1DAF
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: WIN-9P8L97OHU8U
Sending IP: 185.202.175.183
From: Gualaine Exports L.L.C <cathrinemalone66@gmail.com>
Subject: Re: Fwd: Bank Transfer
Attachment: INVOICE.img (contains "Payment Invoice6.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.628.12407.29149.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e49d03fa08be12409e1ce789de473f8da38c82dd2cb295696dbe4eff7988261/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 08:14:08 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hze5ap5arpqsicpbzz4j3zdt7dndrsbn2lfssvuw3pso754yqjqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/3e49d03fa08be12409e1ce789de473f8da38c82dd2cb295696dbe4eff7988261

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 3e49d03fa08be12409e1ce789de473f8da38c82dd2cb295696dbe4eff7988261

(this sample)

AgentTesla

Executable exe b4f3e4e4944feec650a867bf81338829c21a170f174681d36cdd980dabbee1f3

  
Dropping
MD5 8a06781c34523cb81e87fd673ad1406f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4f3e4e4944feec650a867bf81338829c21a170f174681d36cdd980dabbee1f3

Comments