MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74b7ea02de9f9cf8d93f1520e5a03eea22722f488cf5d8e780b8d0575e2b97b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74b7ea02de9f9cf8d93f1520e5a03eea22722f488cf5d8e780b8d0575e2b97b7
SHA3-384 hash: 181c0510372d3c36829a27dc04e6a2b0e334882ee181b05984fd59b71898f4eda2625207e3b9a811cb699120bec1e850
SHA1 hash: e592db7c196c4892a2ba845922b766d3b6d81c82
MD5 hash: a1403febb5107873bf3780bd9035d5a4
humanhash: autumn-fanta-kilo-vegan
File name:PO6320.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-03 08:56:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Qy6DTE+X2rfwA2J4fUIYZSvnHPNM1J11aOYCZpi0i:QpL2r8fIYZSvwHrri
TLSH B745F14532495E27CABC44F280B2228943F4911666B7EBC9BDCD25DB2BF6BF08901F57
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.hiskaol.ga
Sending IP: 89.32.41.144
From: Devang Goenka <sales@hiskaol.ga>
Subject: Re:PO6320 For Shipment
Attachment: PO6320.IMG (contains "PO6320.exe")

AgentTesla SMTP exfil server:
mail.thepackaging.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 00:04:00 UTC
AV detection:
10 of 31 (32.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=os36uaw6t6oprwj7cuqolib65irhel2irt25rz4axdifoxrls63q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 74b7ea02de9f9cf8d93f1520e5a03eea22722f488cf5d8e780b8d0575e2b97b7

(this sample)

AgentTesla

Executable exe 79bfd222eaaeba868d6c0fdc76fff4980e9415b11633d0e98b940aa0ef922a80

  
Dropping
MD5 f72b401ea5d1416d4f0cf2a353eb7da9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79bfd222eaaeba868d6c0fdc76fff4980e9415b11633d0e98b940aa0ef922a80

Comments