MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1596b9d3f30a4b7ec94a7a52f92ec5e9ad649f16406666d743d91cc850448ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1596b9d3f30a4b7ec94a7a52f92ec5e9ad649f16406666d743d91cc850448ee
SHA3-384 hash: c0cbae5002cc2166ab2e3e9ded4f108f93b571b4425e29aacd362ec96f4171ee88d43d453aed7f7752a75d0d3012365d
SHA1 hash: 7bd3c134c5158f4a1937cd4750dfdad989f959a6
MD5 hash: 8c564bdca10d68fc2232420b89e7be4b
humanhash: alanine-lake-nitrogen-diet
File name:PO.202001200939.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'097'152 bytes
First seen:2020-04-30 12:34:57 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaTbNL5cGbTVTr1S5:ih+ZkldoPK8YaTbF+I5rq
TLSH F1A5CF0273918025FEAE91735B55B241D6BCEC250123857F22BAEF78AB721711F2D26F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.212
From: ref@intertach-group.com
Subject: Re: Order Inquiry
Attachment: PO.202001200939.IMG (contains "PO 202001200939.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 02:02:32 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfmwxhj7gcslp3euu6ss7exml2nnmsprmqdgm3luhwi4zbiejdxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img b1596b9d3f30a4b7ec94a7a52f92ec5e9ad649f16406666d743d91cc850448ee

(this sample)

AgentTesla

Executable exe f96388d249bd9b8d6e1250b79c906c2ce70574d710f93c34cc060a1f95dba27a

  
Dropping
MD5 57fa976069dcba1617e621a71dc527d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f96388d249bd9b8d6e1250b79c906c2ce70574d710f93c34cc060a1f95dba27a

Comments