MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfdf578a59187996fbcee39433b5dad6c3018f89556d9e544c17eb2687af4abb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfdf578a59187996fbcee39433b5dad6c3018f89556d9e544c17eb2687af4abb
SHA3-384 hash: 256be0886e2e3a150ee4318c0276390c4017693c2b6d82494bdd9efc450b863f79a092fb2b6e5acabba841e189fc30fe
SHA1 hash: 76c059880047d9514aa4044191658fd92ca903f3
MD5 hash: d19a99b8494b3761b25166a477985753
humanhash: beer-six-early-freddie
File name:PO AUXT20190827_PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2020-08-06 06:49:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:VmSzbJHTsM8Hz45w8dw0GwI+FWELO1Hi2:bZ18Hz45wIGIFk1H
TLSH DF555A2461750697D7EC90B44F0C72485AE386B91E9FF6C1FDB72885F2826B06B2DC1B
Reporter abuse_ch
Tags:AgentTesla img SendGrid


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: wrqvzrvn.outbound-mail.sendgrid.net
Sending IP: 149.72.229.130
From: Henry Fam <izi@usa2georgia.com>
Subject: PO AUXT20190827
Attachment: PO AUXT20190827_PDF.IMG (contains "PO AUXT20190827_PDF.exe")

AgentTesla SMTP exfil server:
smtp.urban.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfdf578a59187996fbcee39433b5dad6c3018f89556d9e544c17eb2687af4abb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 03:17:25 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7pvpcszdb4zn66o4okdhno223bqdd4jkvwz4vcmc7vsnb5pjk5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bfdf578a59187996fbcee39433b5dad6c3018f89556d9e544c17eb2687af4abb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img bfdf578a59187996fbcee39433b5dad6c3018f89556d9e544c17eb2687af4abb

(this sample)

AgentTesla

Executable exe b1135688496020eb3e075121b22fb9c726c6021068ce415be82d8e48540dc563

  
Dropping
MD5 59377d421a5d8d2db2fb28b876ce842f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1135688496020eb3e075121b22fb9c726c6021068ce415be82d8e48540dc563

Comments