MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba77a63031e82c3731c8c2fd6b032e32b7d8d275027cc5ab634184a574845ecb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba77a63031e82c3731c8c2fd6b032e32b7d8d275027cc5ab634184a574845ecb
SHA3-384 hash: d2b69bb90c12fa70e0d931cf12760ea751efdad920978062f49fe6e060e1ed7bf040ab2b0c2c970cd52fe1b79f5bac16
SHA1 hash: b0df43339b0762e74a06f44ea8655ae8e621575f
MD5 hash: 93ff4f8ed5fd7889a77fa61ac9ae8122
humanhash: network-potato-table-iowa
File name:doc009082020.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-10 09:58:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:WclD49gXSs2WjMT/lAZRuZTjzzpAkaqhZO:WmDh5xATN28Nz9Akaq
TLSH CF4512E4E390C03BF9B5093558751E557FEFAC0AA0960A0A7B1C39597BF2251C60B98F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.nichtech.eu
Sending IP: 192.236.146.224
From: Linda Lim <info@dirllquest.com>
Subject: Over Due Payments
Attachment: doc009082020.img (contains "viporigin file.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.ObfusRansom.bc.6542.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba77a63031e82c3731c8c2fd6b032e32b7d8d275027cc5ab634184a574845ecb/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 06:02:52 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xj32mmbr5awdomoiyl6wwazogk35rutvaj6mlk3digckk5eel3fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba77a63031e82c3731c8c2fd6b032e32b7d8d275027cc5ab634184a574845ecb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ba77a63031e82c3731c8c2fd6b032e32b7d8d275027cc5ab634184a574845ecb

(this sample)

AgentTesla

Executable exe 5b13588741f33a75c4e277d1e38b875e3b495c31980a2a41d7c25a2fde3d398d

  
Dropping
MD5 961d3e5df9d3bf24a22e86fe7bfaf529
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b13588741f33a75c4e277d1e38b875e3b495c31980a2a41d7c25a2fde3d398d

Comments