MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a6d429d53588748bd0f8cefdb04ebb8527a8f9e2067b813603f27c6f0e5f785. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a6d429d53588748bd0f8cefdb04ebb8527a8f9e2067b813603f27c6f0e5f785
SHA3-384 hash: 8a8e4546c3abb6bb83ffd17d2ca85edd480206de5dbd6227f400d7e4f58629e857ece3caef15c391c587ba736efdc431
SHA1 hash: 830079a307ad13b79d6b97f87653dfe876112dfc
MD5 hash: a8e354628e954c37aa0aee79be56a29f
humanhash: yankee-high-stream-tango
File name:20201014.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-15 12:22:05 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:5dapVcPI/zWBrbFrkBCwoDp0UlSIanLk1/OWaIwU++:5dRPI4r8GDpzlyY1V6
TLSH AE45F12533856B1AE13DA3B334F4463013F662899327D60A3FEC23951B67F80B65676B
Reporter abuse_ch
Tags:AgentTesla img Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic303-22.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.242.39
From: Kiyotaka CRC <kiyotakacr@gmail.com>
Reply-To: kiyotakacrc@gmail.com
Subject: Invoice for Payment
Attachment: 20201014.IMG (contains "20201014.exe")

AgentTesla SMTP exfil server:
smtp.epak-de.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.9776.17116.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a6d429d53588748bd0f8cefdb04ebb8527a8f9e2067b813603f27c6f0e5f785/
Threat name:
ByteCode-MSIL.Spyware.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 00:40:43 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjwufhktlcdurpiprtx5wbhlxbjhvd46ebt3qe3ah4t4n4hf66cq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8a6d429d53588748bd0f8cefdb04ebb8527a8f9e2067b813603f27c6f0e5f785

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 8a6d429d53588748bd0f8cefdb04ebb8527a8f9e2067b813603f27c6f0e5f785

(this sample)

AgentTesla

Executable exe 419866e243e8c421e9ddaa512c0aaabb4454b57e684855d23576daa570a58957

  
Dropping
MD5 e497901e873816b7fce754d5e13b4a55
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 419866e243e8c421e9ddaa512c0aaabb4454b57e684855d23576daa570a58957

Comments