MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79837f0b4bff54a93d9153b1ce9fc2acbb1521bebe1e4d34f73ba3d2e2fbe47c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79837f0b4bff54a93d9153b1ce9fc2acbb1521bebe1e4d34f73ba3d2e2fbe47c
SHA3-384 hash: a9e45c332e7597b3ffce5bb1b518bdad0eea5eeb0ebada5c07561947d5578d16087e6d4219828d644f0b112d8f47202e
SHA1 hash: 02750d9e3d07c48c313bb74814d0a0297246167e
MD5 hash: d3b5fcbfff1b172f1d10a76d3e3d12ca
humanhash: sink-kilo-uranus-eighteen
File name:Purchase order from Innovix Distribution Limited.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-18 06:01:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:5c6eTRV/SvnRTgqkstGB1XAI9hAnBxS4epu7:S6KzKPRTgZsCZ96nBxXep
TLSH 5F45010A775C9B12C56A0A7EC4EA500403B9AD523772E71E3B9D739C0F637D79903A8B
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-241-215-152.unifiedlayer.com
Sending IP: 162.241.215.152
From: Eric Wang <ericwang-hk@innovix.com>
Reply-To: Eric Wang <ericwang-hk@innovix.com>
Subject: REQUEST FOR QUOTATION - NO: 792-286
Attachment: Purchase order from Innovix Distribution Limited.img (contains "Purchase order from Innovix Distribution Limited.exe")

AgentTesla SMTP exfil server:
mail.ontime.com.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:03:10 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgbx6c2l75kkspmrkoy45h6cvs5rkin6xype2nhxhor5fyx34r6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 79837f0b4bff54a93d9153b1ce9fc2acbb1521bebe1e4d34f73ba3d2e2fbe47c

(this sample)

AgentTesla

Executable exe b043fb26df3ef363242188bee6b805f9a04e003408885cabfc6d575291d63bde

  
Dropping
MD5 f2e00a1f15cb90a4bb27de8f34b66c06
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b043fb26df3ef363242188bee6b805f9a04e003408885cabfc6d575291d63bde

Comments