MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d743bbfcdc9b3b4dbf1737691da4ed973596ce087cac413e501b0c667cc9c083. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d743bbfcdc9b3b4dbf1737691da4ed973596ce087cac413e501b0c667cc9c083
SHA3-384 hash: 2219e1b6bbb79b21db769ce28d21cb0235ca56bbd3c00ab06c2b7819c6c0d11969ec2786edc9cc7cbafac827f4c367a0
SHA1 hash: e4476fb744c1aace889168a5740244fc42369202
MD5 hash: 4839cb5910820be27aff1581df13dccb
humanhash: twelve-double-skylark-sweet
File name:Invoice for payment.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-05-28 08:40:05 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:D4GSI6VEt6KS9dETFmGV6K2HOoj+GXHUoXqpu1m7oe:RSI6NVAV6K2HOoj5XHtXqG
TLSH B9555D39F684A805D03C067604B556907277FA837A21C31F3ACF736C6F623EB7256A5A
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host2.themusclemaximizer.com
Sending IP: 67.43.9.162
From: <sales@victim-domain>
Subject: victim-domain Invoice for payment
Attachment: Invoice for payment.img (contains "Invoice for payment.scr")

AgentTesla SMTP exfil server:
mail.brigadistacivil.com.br:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 09:36:19 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d743bbfcdc9b3b4dbf1737691da4ed973596ce087cac413e501b0c667cc9c083

(this sample)

AgentTesla

Executable exe 20667ee444d9dc8dc5135d0c4e29da6289572153ab6400534c1c6261d7503a64

  
Dropping
MD5 3b6dbedcd58684f2bafd91b2c64d52a9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20667ee444d9dc8dc5135d0c4e29da6289572153ab6400534c1c6261d7503a64

Comments