MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b2e67417620e03358288cf5e0e7b7fc48d599cc9fe78656c7b5d194c92f28b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b2e67417620e03358288cf5e0e7b7fc48d599cc9fe78656c7b5d194c92f28b8
SHA3-384 hash: 86f5656990775c9afce11042251ab1c4eb75e5b50fefd7fe9ed0ad92d8d2c36a7f91c9c9e33e0f8321bca591c761034e
SHA1 hash: f06eaa3cc85d8379de83d9b42a4ebf78440cf934
MD5 hash: 417ad3b590deac8770e799e9d51a7d79
humanhash: apart-finch-hydrogen-failed
File name:QUO60601.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-19 14:18:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:vqeFotCvXxR57Q7OFBPC1BfBCE7kwSKuN+aX6gTsY2h6AH/ZPVsy/VA+6Im:vKtGxoEK7ftgWgTsQssyG+6
TLSH 3945018057AC0BA2C43C9BF46260241247BABC77F291E71E7DCDB0D613B6F604952E6B
Reporter abuse_ch
Tags:AgentTesla img PWC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pwc.com
Sending IP: 37.48.85.242
From: Morgan <syafiq.adnan@pwc.com>
Reply-To: Jessica.Jang@morganplc.com
Subject: NEW_Quo60601
Attachment: QUO60601.IMG (contains "QUO60601.exe")

AgentTesla SMTP exfil server:
smtp.jpme.org.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200519-1503.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 19:08:00 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmxgoqlwedqdgwbirt26bz5x7renlgomt7tymvwhwxizjsjpfc4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 8b2e67417620e03358288cf5e0e7b7fc48d599cc9fe78656c7b5d194c92f28b8

(this sample)

AgentTesla

Executable exe 74b007c1e2f24acb26e90f1d5a06ea24b625267b0a722aa1dcdf0ddfa0becc69

  
Dropping
MD5 43057371a7345c7f5462ab421666cc83
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74b007c1e2f24acb26e90f1d5a06ea24b625267b0a722aa1dcdf0ddfa0becc69

Comments