MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c05dbacbca48f0956c05bcc8e7b5214b5ad6cc23673bc126f8ed98a3e1502610. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c05dbacbca48f0956c05bcc8e7b5214b5ad6cc23673bc126f8ed98a3e1502610
SHA3-384 hash: 711bae483ce9de0d2341f2b7b29d98ab74a2776c4894e0d973c96c3d837edf19a86216a71075cf8dcc3a9a3606c3d210
SHA1 hash: a8856f54b73d30b393e40c83cb7295e3e1cd64c1
MD5 hash: fc3c6e0ef64f9ea26ff7815e17874311
humanhash: asparagus-charlie-table-oven
File name:PO_003002939.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:626'688 bytes
First seen:2020-07-28 15:45:22 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:fDuBxStSvtcl6PwkZQ5vex4CrgGek/swWmw1Nidded4SFP6n4gQ:fSPNvttPvZQ5vebrmgswo8ddy/
TLSH 14D4E00421A81B1FD75B84B56427C0F02227D095EB61EE736E9FE0A71AC26FE35C3667
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mieq.com
Sending IP: 193.142.59.89
From: wan.azwanie@mieq.com
Subject: Urgent Purchase Order (PO2001-00106)
Attachment: PO_003002939.img (contains "PO_003002939.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c05dbacbca48f0956c05bcc8e7b5214b5ad6cc23673bc126f8ed98a3e1502610/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 15:47:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ybo3vs6kjdyjk3afxteopnjbjnnnntbdm454cjxy5wmkhykqeyia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c05dbacbca48f0956c05bcc8e7b5214b5ad6cc23673bc126f8ed98a3e1502610

(this sample)

AgentTesla

Executable exe 7b33b7ae792e3798138b97077985dc2d443977255a9320e4bfbd14d3eb46d147

  
Dropping
MD5 59e99862e1433c6c506dc03cc775daf6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7b33b7ae792e3798138b97077985dc2d443977255a9320e4bfbd14d3eb46d147

Comments