MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 847ad81c7bfc38a98a6e9f1581478831b83f587de9861801ebf3f7cbc856f474. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 847ad81c7bfc38a98a6e9f1581478831b83f587de9861801ebf3f7cbc856f474
SHA3-384 hash: 2ea81c2b9fa5475f828688b19cb592d4e6c2664ed55b84d61432bc7913aaecf13afa05e976441876d9aec23fd964f5f3
SHA1 hash: ff5a4f26947a0b3d59da5066244f9a21591b0e0f
MD5 hash: b8d09bbb83f9dff01ab954ec77aabcce
humanhash: connecticut-bakerloo-steak-edward
File name:Image001.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:925'696 bytes
First seen:2020-08-10 13:07:01 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:RQoTCHdOasekxlSBWq6UDb9BxgMBFGCeR7Hf0hUZ74WhgKcC6a2lzXzTW4H:K4UOaeCWal93GVRLc8gKz6dB/W
TLSH 8F157B17F1DC48BFC362D93B9E3B52B758E6B9132A3458453BE4684C4A392782C152FE
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bernoulli.se
Sending IP: 185.222.57.157
From: Jonas Öhrn <jonas@bernoulli.se>
Subject: Re Transfer confirmation
Attachment: Image001.img (contains "Image001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BScope.Adware.Kraddare.1524.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/847ad81c7bfc38a98a6e9f1581478831b83f587de9861801ebf3f7cbc856f474/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 13:08:16 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qr5nqhd37q4ktctot4kycr4igg4d6wd55gdbqapl6p34xscw6r2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/847ad81c7bfc38a98a6e9f1581478831b83f587de9861801ebf3f7cbc856f474

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 847ad81c7bfc38a98a6e9f1581478831b83f587de9861801ebf3f7cbc856f474

(this sample)

AgentTesla

Executable exe 3ddfcc0ce0a57e7f3131d0ba603d6516f00c6cf94f67e79ab38a7e8f922f74bc

  
Dropping
MD5 8edfc0c9b66d619863da78543d8b2ebb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ddfcc0ce0a57e7f3131d0ba603d6516f00c6cf94f67e79ab38a7e8f922f74bc

Comments