MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65657aeeeabb0444832295231e28c216ee638488b8670edf24557c0c02482ed4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65657aeeeabb0444832295231e28c216ee638488b8670edf24557c0c02482ed4
SHA3-384 hash: dcddbdbcd6f53008cb3a291415d08430e322428c0664fa51744340f34240f6134a2a6f643fa746188df259f36f922a13
SHA1 hash: 7e68d72297a082f6e4944ae003ed1bf451dff88b
MD5 hash: c042b2bdd0da396fdfcef0888b539551
humanhash: maryland-william-mobile-pluto
File name:PO200604002_SNSM-200602-02.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-02 06:59:41 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:FJcLidtBk1gwU8bDHWtrdFP+7+3VtsfuMjZMNQTnizmbthLAKzZsx5Lzff:yidtuPH+2t/ZMNaizEtBF+3f
TLSH 8345E0246BFC5228FEBE1A70AEB546445733B5946435D31E3A5C601E1FBBF008A91B73
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.205
From: info <info@swanskates.com>
Subject: Revised Order
Attachment: PO200604002_SNSM-200602-02.img (contains "Quotation.exe")

AgentTesla C2:
http://almm.polisamo.com//inc/67e90431a7e061.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WQV.20973.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65657aeeeabb0444832295231e28c216ee638488b8670edf24557c0c02482ed4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:01:04 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mvsxv3xkxmcejazcsurr4kgcc3xghbeixbtq5xzekv6ayasif3ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 65657aeeeabb0444832295231e28c216ee638488b8670edf24557c0c02482ed4

(this sample)

AgentTesla

Executable exe 46abd3805e5ec1a866ec2d4dd13be62b40d76ca6c0002347ed33699039e4c977

  
Dropping
MD5 b8bd32c75c66025888ccdffe9be993ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46abd3805e5ec1a866ec2d4dd13be62b40d76ca6c0002347ed33699039e4c977

Comments