MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b062a08f0fefaa4d53f6f282e6edfab201c1dc986a86c91638b5fb7d919f5bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b062a08f0fefaa4d53f6f282e6edfab201c1dc986a86c91638b5fb7d919f5bd
SHA3-384 hash: 0db58bdd8b7d095430913b327df44a9e6a553753ac082cad2b3ddea968cf72c3183462c598dbbd567048b715f7640116
SHA1 hash: 9b1ebeed05108c5120047dd0f0f3b13ed89a6e41
MD5 hash: 7d9b2dac95f64d71ab24c1ff56bcaf4b
humanhash: enemy-network-eight-mexico
File name:POHTOP999999_FGH445569999SA_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'769'472 bytes
First seen:2020-08-04 06:41:30 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:BHcPgYxmOE+2Do4pPeRH89flMSZL76J9EuHftknOi9/aHb+IlDV4:6IYxPeVZlUYLy9tMgb5V
TLSH 02855AF1ECF1CA40D81515F6C92E85958AE2AD2ADF425D02F18CB71427B21CDEDE8AD3
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.sinnerbrinks.de
Sending IP: 192.236.192.165
From: Merveilleux Enterprises Inc <macky@sinnerbrinks.de>
Subject: Request For Quotation
Attachment: POHTOP999999_FGH445569999SA_pdf.img (contains "PO#HTOP999999_FGH445569999SA_pdf.scr")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.48221.15789.21494.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b062a08f0fefaa4d53f6f282e6edfab201c1dc986a86c91638b5fb7d919f5bd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 04:17:20 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmdcuchq735kjvj7n4uc43w7vmqbyhojq2ugzeldrnp3pwiz6w6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b062a08f0fefaa4d53f6f282e6edfab201c1dc986a86c91638b5fb7d919f5bd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4b062a08f0fefaa4d53f6f282e6edfab201c1dc986a86c91638b5fb7d919f5bd

(this sample)

AgentTesla

Executable exe 978c0c4eff3ce564b52a92cb190be37fb85abae2d85153e202b87787c964136f

  
Dropping
MD5 0c7f81f15ab27683999db58fd787f105
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 978c0c4eff3ce564b52a92cb190be37fb85abae2d85153e202b87787c964136f

Comments