MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d8c4fa76e8f6ff51aa078c55be3daf21edaed0987f783cc5f4bef76e7c42c37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d8c4fa76e8f6ff51aa078c55be3daf21edaed0987f783cc5f4bef76e7c42c37
SHA3-384 hash: a81e13508fa6e01e1e1af3443369f4f90288316475cdac883470bd2e18a6060f09d8cbb9d9b766e43948f81596e42819
SHA1 hash: cb2aa9182054a26be1ca2dccfe36950a3e1b53b7
MD5 hash: d20e4773722dcdd44c6686ef8c7e22fe
humanhash: montana-nebraska-carbon-quebec
File name:SBU 122 NEW Prices LBP.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'441'792 bytes
First seen:2021-02-09 06:10:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:xh0tJpQSnZl+lZbAyFTYTHEa4fR+Jn0QzJoGpmaz4vHXsC8xC6xiQQR6PcvqyF:xK98b9TcHEZ40RGpxzsHXz8xC6V
TLSH BA65AD9272705747EFA5B7F11C304A8052F5EC1AEA31C19DB8D873ADEB74AE3512D282
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Perla.Touma@fattal.com.lb" (likely spoofed)
Received: "from fattal.com.lb (hwsrv-825993.hostwindsdns.com [192.236.146.151]) "
Date: "08 Feb 2021 22:27:08 +0000"
Subject: "Quotation requirement -Romance SAL /Lebanon "
Attachment: "SBU 122 NEW Prices LBP.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36318625.4321.21080.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d8c4fa76e8f6ff51aa078c55be3daf21edaed0987f783cc5f4bef76e7c42c37/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 06:11:06 UTC
File Type:
Binary (Archive)
Extracted files:
53
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwge7j3or5x7kgvapdcvxy626ipnv3ijq73yhtc7jpxxnz6efq3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8d8c4fa76e8f6ff51aa078c55be3daf21edaed0987f783cc5f4bef76e7c42c37

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 8d8c4fa76e8f6ff51aa078c55be3daf21edaed0987f783cc5f4bef76e7c42c37

(this sample)

AgentTesla

Executable exe c5f22bdcd77c01bfbe591272cb127809b295eb1f2d20e4b3ab49a6cb8c6cba48

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5f22bdcd77c01bfbe591272cb127809b295eb1f2d20e4b3ab49a6cb8c6cba48
  
Dropping
AgentTesla

Comments