MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4352b9590b958c7fcee31f8788bacd2bf5b4147ae0ef78ea38d2a6be34439a80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4352b9590b958c7fcee31f8788bacd2bf5b4147ae0ef78ea38d2a6be34439a80
SHA3-384 hash: 96802547548aa4492222560f572a428bdeec0f9aab3116c4c0f5b63c9f83ad27370cc0454c840b6df85fbb489014c611
SHA1 hash: ff4a1b1ac4c29b5384ced2a04a32b7551f6e526e
MD5 hash: 4a5c048ca89db1e62d83730040d057c7
humanhash: nineteen-idaho-potato-november
File name:Picture1.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-01 11:24:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:RsYEQDzYAaNvSX44gc5aAsDuaxo/gVofmlUeEu934tOqa2/TEP8I32iu6P39llOE:RLUAaNn39Dua5Ua92HTq8ImiuA9bs
TLSH 36450153EF95C231DE9C1B7715A1130ECBB89BE62152E74E7A9C2D480BB3B135520BCA
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.goberks.com
Sending IP: 45.95.168.139
From: Goberks Inc<info@goberks.com>
Subject: Property Sale
Attachment: Picture1.img (contains "Picture1.exe")

AgentTesla SMTP exfil server:
altaradiproperties.com:587

AgentTesla SMTP exfil email address:
rashid@altaradiproperties.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48211.31002.20885.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 11:36:05 UTC
File Type:
Binary (Archive)
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=injlswilswgh7txdd6dyrownfp23ifd24dxxr2ry2ktl4ncdtkaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4352b9590b958c7fcee31f8788bacd2bf5b4147ae0ef78ea38d2a6be34439a80

(this sample)

AgentTesla

Executable exe 81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8

  
Dropping
MD5 597b73672275a514feefc5e091d99fff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8

Comments