MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9f737d24b6c83f72e6072b658b5548a815daff862775b26094811b94036a7e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9f737d24b6c83f72e6072b658b5548a815daff862775b26094811b94036a7e7
SHA3-384 hash: 4ef7bd0c837b331ce9f7b9099a2aa670fdca3d8938e02b2b704d30f324b3a831e84de2665913ae90f14021c55044a37e
SHA1 hash: 7d6cd0a47283c7b51eac1b4eade08cc2531a3f2d
MD5 hash: b1911da1bfeaf4edc995733830f709dc
humanhash: wisconsin-river-twenty-three
File name:Fattura a saldo lavor8013667PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'441'792 bytes
First seen:2020-08-11 13:58:20 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:6OBz+gcLSxbH3cAUyeK2jPTxh6tXVhy5GeaUQ2o+LoLJv4i4Qq3iLg+lBDd0+Mh8:6OyabXcAUYswXz3RUboL64BFMuMnXU
TLSH 3C65F62E7601E509D13C1532C494A6F162716D8BEA12CA1F35CE3F9E7F3368B374698A
Reporter abuse_ch
Tags:AgentTesla geo img ITA


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alpenwald.it
Sending IP: 104.168.148.112
From: Amministrazione<amministrazione@alpenwald.it>
Subject: Re: fattura a saldo lavori etra bassano del grappa
Attachment: Fattura a saldo lavor8013667PDF.img (contains "8013667PDF.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.MSIL.Pretoria.1.914.4167.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9f737d24b6c83f72e6072b658b5548a815daff862775b26094811b94036a7e7/
Threat name:
ByteCode-MSIL.Trojan.Pretoria
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:00:09 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xh3tpuslnsb7oltaok3frnkurkav3l7ymj3vwjqjjai3sqbwu7tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b9f737d24b6c83f72e6072b658b5548a815daff862775b26094811b94036a7e7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img b9f737d24b6c83f72e6072b658b5548a815daff862775b26094811b94036a7e7

(this sample)

AgentTesla

Executable exe cbf136bcf2b8a2b127edb351d66c62da8e9fefa572d5ceb4210af5fc96cb23b1

  
Dropping
MD5 f454bda25e754ff811d5f24faea96686
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cbf136bcf2b8a2b127edb351d66c62da8e9fefa572d5ceb4210af5fc96cb23b1

Comments