MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 734e94a162edaa56d138fbfd055b6e356630eed1e7011dc9c7a150ffaed4c401. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 734e94a162edaa56d138fbfd055b6e356630eed1e7011dc9c7a150ffaed4c401
SHA3-384 hash: 615a0b1d5827d3ab0c94e7a1abd01843ac581024fc8bc569e75d83f3a863b21ec946846dac425b917aff2d7d07da734b
SHA1 hash: bf7d9fa555d529525f0f3979ff43129118762ba3
MD5 hash: 2e8a4a745d822a9e23859de38a9d6eff
humanhash: lithium-vegan-hawaii-lamp
File name:OLD AND NEW INQUIRY.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2020-06-03 14:47:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:eS7XA+sMoxdVnjwFz4mLdER1dIk+NneQMGsaUSaLYJeIIS41w8U98KVI0W0qKGC1:lU+IxdVUNheC8nutx
TLSH 75554A9C311076EFC867D4729AE81D68EA707C7B531F4243A42715ADAA4C9AFCF244F2
Reporter abuse_ch
Tags:AgentTesla img Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic310-48.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.69.174
From: Grace <gavlncorpnat@yahoo.com>
Reply-To: gavlncorpnat@yahoo.com
Subject: INQUIRY
Attachment: OLD AND NEW INQUIRY.IMG (contains "INQUIRY AND PICTURES.scr")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 15:36:03 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=onhjjilc5wvfnujy7p6qkw3ogvtdb3wr44ar3sohufip7lwuyqaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 734e94a162edaa56d138fbfd055b6e356630eed1e7011dc9c7a150ffaed4c401

(this sample)

AgentTesla

Executable exe 97d00afa2bed061dcaf9ab0c3eb749ab0e083fc645c7a8540521adb6951e15b2

  
Dropping
MD5 fc5f347df19d299a465d6fb066001b66
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97d00afa2bed061dcaf9ab0c3eb749ab0e083fc645c7a8540521adb6951e15b2

Comments