MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41ecb3f14383b96d91d21bba29fbb17f0620b739c893cdc608c71a1c75584280. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41ecb3f14383b96d91d21bba29fbb17f0620b739c893cdc608c71a1c75584280
SHA3-384 hash: 75fec887c60f2f0c5a375ac8c0549e82b80ca118ec80231f1453bf2b295e773c5ea68d0d7aff54353fd519c6eecbf37f
SHA1 hash: 9d5778c5dd543817c71e27b276cd074a2260d9d3
MD5 hash: 766de73e722d81b7a2ce549611f0af36
humanhash: xray-zebra-wisconsin-chicken
File name:New and old Lists.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'555'904 bytes
First seen:2020-07-24 10:47:20 UTC
Last seen:2020-07-24 10:47:38 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 49152:CSDHLxX6dzg5DplXvm/975dfQuq5iAFeD:zDrxXozCDC7dfFq5Ls
TLSH 4AC59C412A941A8FF56D777973A314105BB8AC151A3BDE2D3DE6F0EC1932338EA02767
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.fundscript.xyz
Sending IP: 45.95.169.179
From: info@fundscript.xyz
Reply-To: info@fundscript.xyz
Subject: Quote#CON-071720-EB
Attachment: New and old Lists.img (contains "Pictures.exe")

AgentTesla SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41ecb3f14383b96d91d21bba29fbb17f0620b739c893cdc608c71a1c75584280/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 10:49:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihwlh4kdqo4w3eosdo5ct65rp4dcbnzzzcj43rqiy4nby5kyikaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41ecb3f14383b96d91d21bba29fbb17f0620b739c893cdc608c71a1c75584280

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 41ecb3f14383b96d91d21bba29fbb17f0620b739c893cdc608c71a1c75584280

(this sample)

AgentTesla

Executable exe 1cff19685b36b678ecd8a9d4bd7a5fe366bd3340de67528b2b444f6c9fd841d1

  
Dropping
MD5 681f3a6515a7179e38a164abdf555514
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1cff19685b36b678ecd8a9d4bd7a5fe366bd3340de67528b2b444f6c9fd841d1
  
Dropping
SHA256 1ab199282785da53b5d473ab89af264ae67dda695946890c76a8266a7d80352c
  
Dropping
MD5 96b39508ca6c74a94638bf4bbb825e8e

Comments