MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 886c62a9c5934fbab8b8cd6396b40e46971a8419207ae5ca08114a52dd9406da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 886c62a9c5934fbab8b8cd6396b40e46971a8419207ae5ca08114a52dd9406da
SHA3-384 hash: 1f550cde1bbc9422c4de9845058dca837b9956cf77ebcc1b646f5d8f1f654c24df6646dcb46d481df8e7a0757d5fa1ed
SHA1 hash: 80ae10090cc3ee3015f7599ffdb7d9d34a235973
MD5 hash: a6959ff2cc264df68340907a67dac8ea
humanhash: mirror-shade-ink-mountain
File name:VTECH RFQ - 164873.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-31 06:54:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:uanIKWtJP377/TBimrskeTHDwqLq6yQShVaH880iBuPuB:iKWtJP3XUmioqLq6yRhD80iBnB
TLSH 96452205338180E3DDA813732077E72966A06C3921B6E28F33DDBB5D6B731D1862F689
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.charypublications.com
Sending IP: 67.211.216.5
From: Moises Luis Terol <moises@vtechsa.com>
Subject: VTECH RFQ - 164873 / VTECH PROJ #: PA-0724, END USER BRAZIL
Attachment: VTECH RFQ - 164873.IMG (contains "VTECH RFQ - 164873.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/886c62a9c5934fbab8b8cd6396b40e46971a8419207ae5ca08114a52dd9406da/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Suspicious
First seen:
2020-07-31 06:56:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbwgfkofsnh3vofyzvrznnaoi2lrvbazeb5olsqicffffxmua3na._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/886c62a9c5934fbab8b8cd6396b40e46971a8419207ae5ca08114a52dd9406da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 886c62a9c5934fbab8b8cd6396b40e46971a8419207ae5ca08114a52dd9406da

(this sample)

AgentTesla

Executable exe 71bf82d361e416132b74f9357e43d9716529dcb0fae3d464cffc5b984d922227

  
Dropping
MD5 878d32f2f56d4f2b40a64ed91e7b7ce0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71bf82d361e416132b74f9357e43d9716529dcb0fae3d464cffc5b984d922227

Comments