MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89aac27ae48eda74a5d5cb0c461289e6b42588cf34b17c249ed83dd982a6d5d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89aac27ae48eda74a5d5cb0c461289e6b42588cf34b17c249ed83dd982a6d5d7
SHA3-384 hash: 3bb4ea07a804d15c9124e330799c37c83471f079b6681c59c313686b2df2892a77385a65983a3beaf60f2697b15efc87
SHA1 hash: 6f813a784dea63ab0177d47ee6c06c64927e4f8a
MD5 hash: a7d1a584e423369a9d1673b4d98572a4
humanhash: hotel-mirror-asparagus-mars
File name:Invoice9990012.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-28 14:06:45 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:PhHVKyeOn5/OCFRwpqhTTx63R2vpbGAQR/9qFY13abdGpzGK6qvLFTo+DjDmZTmC:pHVK1oFyp+Tc3OfQ9AJm6mDRFGRm6J
TLSH 5945E00122945B1FD76B86B47027D1F00227E495EBA1EE376D8FE09B1AD26FC39C3652
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.ocurilem.com
Sending IP: 45.95.170.161
From: Angelo.fanfarillo@cifasrl.it
Reply-To: accounts@cifasrl.it, admin@cifasrl.it
Subject: New Order
Attachment: Invoice9990012.img (contains "q3myYW9NF05iAGK.exe")

AgentTesla FTP exfil server:
asnbanknl.com:21

AgentTesla FTP exfil user name:
smartpips

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52692.13352.15273.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89aac27ae48eda74a5d5cb0c461289e6b42588cf34b17c249ed83dd982a6d5d7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 14:08:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rgvme6xer3nhjjovzmgemeuj422clcgpgsyxyje63a65tavg2xlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 89aac27ae48eda74a5d5cb0c461289e6b42588cf34b17c249ed83dd982a6d5d7

(this sample)

AgentTesla

Executable exe 37150bacbcc388ea4dec116a1c1d22ae9b937a7495e2974228eb4814d2db6348

  
Dropping
MD5 2b410f95e3698318f5183053e38d7e85
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37150bacbcc388ea4dec116a1c1d22ae9b937a7495e2974228eb4814d2db6348

Comments