MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 490ae003a04777adaa2c78dda295a8e2c65b81eb0e1c45a2a4fd741984b28efb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 490ae003a04777adaa2c78dda295a8e2c65b81eb0e1c45a2a4fd741984b28efb
SHA3-384 hash: 426d0af9fc62b6b3ce295b195c581a857ee93ed9430ce24705eb1e3f4338368605539ca2a8a532b63478fae2a0f70dd4
SHA1 hash: ad926db13c4b2a499418f79027c83bd424d81e04
MD5 hash: 74522f51f443ca26e8ccce14c4f31ee6
humanhash: nitrogen-hot-alanine-lemon
File name:SOA.2.0.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-24 06:58:48 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:zansNqrPTX+jO9W5l9VZk1EML46kQAyDb/Y2o/uqqjUyU1Se:lNoyjyW5l97k1EML46khQv
TLSH 8C4512061B11C9F7F92253B22A6A8E3AFA69FD1926311A5F3B5C3304AB771C3591F143
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tradingman.pw
Sending IP: 142.11.219.101
From: Mrs Samah Abu<samah@apex.com>
Subject: RE:Debtors Statement as at April 2020
Attachment: SOA.2.0.IMG (contains "new 1.exe")

AgentTesla SMTP exfil server:
mail.gandi.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 07:35:42 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 490ae003a04777adaa2c78dda295a8e2c65b81eb0e1c45a2a4fd741984b28efb

(this sample)

AgentTesla

Executable exe 8ec65b9bced5fa5082ed515bd116be235dc59be1b2608432e249dfcabed7a64a

  
Dropping
MD5 9c561467148e3706bd50bc2244917a15
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ec65b9bced5fa5082ed515bd116be235dc59be1b2608432e249dfcabed7a64a

Comments