MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5857254c4966490bd5229989276aab93e43c4bb7410d89f676737ab0c1c63e2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5857254c4966490bd5229989276aab93e43c4bb7410d89f676737ab0c1c63e2c
SHA3-384 hash: f746078c15fd6855de9d2acb7349f2589b2b6db515df8cc2ffea9a386fbdff0b2d1046b159543da5d0ecf4d1da83fdfc
SHA1 hash: 79f06f18328d2508d3344b69437304044012aa99
MD5 hash: 1e0c51c5c824718a6344a8f04b2f9bf9
humanhash: asparagus-montana-blossom-ten
File name:Quote U111566611 pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'638'400 bytes
First seen:2020-10-13 10:38:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:iXcrYfqYBdN7hBV2tCY0hDz27T5xVbMg6/MZ5L7dxD+C5FAhgcRS69i/sg:XQB2IDz27T5d6/+5/VaRS6i
TLSH 9E75ADC0EE5BD64AD06542F4C95EC61C9676EF091301DD08BA8AFB8A1236B1CCDC96F7
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: whitehand.zaratrading.tech
Sending IP: 92.204.160.109
From: Simangele Makhoba <mpalme@hellertools.site>
Subject: ENQUIRY
Attachment: Quote U111566611 pdf.img (contains "PO#TUZO7689FD_pdf.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3009.15724.10088.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5857254c4966490bd5229989276aab93e43c4bb7410d89f676737ab0c1c63e2c/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 07:40:56 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lblsktcjmzeqxvjctgeso2vlspsdys5xiegyt5twon5lbqoghywa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/5857254c4966490bd5229989276aab93e43c4bb7410d89f676737ab0c1c63e2c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 5857254c4966490bd5229989276aab93e43c4bb7410d89f676737ab0c1c63e2c

(this sample)

AgentTesla

Executable exe 20417d78d491fe9bd2ceb67a6f45e1dbc28130c9f11c6642b313104e7cc044f9

  
Dropping
MD5 9e787abde0f2cb4f3b5ee9ef52ae1a5e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20417d78d491fe9bd2ceb67a6f45e1dbc28130c9f11c6642b313104e7cc044f9

Comments