MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 823b3fc9bffb074b433166e3d498b751bbdf59c1e08647cf4ed2f179af468743. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 823b3fc9bffb074b433166e3d498b751bbdf59c1e08647cf4ed2f179af468743
SHA3-384 hash: 973e649dc81ca3d4b242772459c875201ef237708f7aa4c210842eb25f8ed0cc8fdf21ca18caea0d9a4f376a734dc580
SHA1 hash: e4dee775c2d5d6751670bb566de0e1d512692439
MD5 hash: 70e21923c5890a492c200463f85696a8
humanhash: five-high-batman-echo
File name:Veladecor_order1000000000.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'521'088 bytes
First seen:2020-05-27 08:06:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:TGSCEt6lOZUmxNimXDlKFLIbsL1swv91SrSlPq2Jwz38O:CSclO6ibql1swHC2eQ
TLSH 2BC53E27EC45C647E02843FDF8571DB46A2F2B85F542A7FE20B61E9E6E012562E8703D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sejon.co.kr
Sending IP: 131.153.50.147
From: Sejon Corporation <sejon@sejon.co.kr>
Subject: Re:Re:Order
Attachment: Veladecor_order1000000000.img (contains "Veladecor_order1000000000_img.exe")

AgentTesla FTP exfil server:
ftp.behnazgroup.ir:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.672294.16149.7358.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Worm.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 08:37:08 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
11 of 30 (36.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 823b3fc9bffb074b433166e3d498b751bbdf59c1e08647cf4ed2f179af468743

(this sample)

AgentTesla

Executable exe aa1cbc4490796352b22e093125284877d57399696b722829f6b1056aa14c2eff

  
Dropping
MD5 bf843f563de7b1d842993131a9710ae7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa1cbc4490796352b22e093125284877d57399696b722829f6b1056aa14c2eff

Comments