MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c13183c38ff89104a562b73ce09a85c00a0488a800afb74ff5733b45087f3b13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: c13183c38ff89104a562b73ce09a85c00a0488a800afb74ff5733b45087f3b13
SHA1 hash: a4d6c00ff365857c870172c10bfb01d621721931
MD5 hash: a9a6b084704c659e05981be5bcd8811c
File name:Inv_213417_from_Anchors_Wire_Services_Ltd._352.pdf.img
Download: download sample
Signature AgentTesla
File size:1'245'184 bytes
First seen:2020-05-22 10:08:10 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:xOJ3tu7qsPqR3WNP2q0PGdNdghwT/HvAo0fv29:x4Tpc0PINdUC/PATa
TLSH 5C45CFA4D3DC6707FAADC5B4E0D1410047E9A4AE054BFBCAF899A0EE4BD73B3944254B
Reporter @abuse_ch
Tags:AgentTesla img


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: nestecinc.com
Sending IP: 96.77.217.250
From: Sales Team<sales@nestecinc.com>
Subject: Purchase Order
Attachment: Inv_213417_from_Anchors_Wire_Services_Ltd._352.pdf.img (contains "Inv_213417_from_Anchors_Wire_Services_Ltd._352.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country US US
ClamAV SecuriteInfo.com.Trojan.Siggen9.48128.29833.3929.UNOFFICIAL
VirusTotal:Virustotal results 24.59%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c13183c38ff89104a562b73ce09a85c00a0488a800afb74ff5733b45087f3b13

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments