MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd6113c9a138aaf824b9fd5b883cae60f926a68ce94927d805e631357891de22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd6113c9a138aaf824b9fd5b883cae60f926a68ce94927d805e631357891de22
SHA3-384 hash: 00e58f4b06b74e2fbcd9bcab98445885d757fabef011777d446ccf2d88a441c115c50716076e87d90f06f8959d4c8d9c
SHA1 hash: 700dac4254d375fc8fadd8fd07973b33e0725212
MD5 hash: 609d3ec67731110ac1cc83b21a6f0849
humanhash: pasta-failed-oxygen-west
File name:PO_050220.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-04 21:46:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:LY8iJtcKX+ymTijUO0Y4gIXXe7cLdTj212otgtmrJN0WcAiSkfhxBtbFix:/gtcKX9mGUO0yXcLdG1NaArIrXSw3P
TLSH 304512E1694185B1F215863247B74F3553FBAE2234A4B117374CB7943BBB2D28B3A683
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.dassd.co.uk
Sending IP: 192.129.254.160
From: erty@dassd.co.uk
Subject: New order & delivery
Attachment: PO_050220.IMG (contains "PO_050220.exe")

AgentTesla SMTP exfil server:
mail.swagopen.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.UGA.20041.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 10:55:15 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vqrhsnbhcvpqjfz7vnyqpfomd4snjum5fespwaf4yytk6er3yra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img dd6113c9a138aaf824b9fd5b883cae60f926a68ce94927d805e631357891de22

(this sample)

AgentTesla

Executable exe 194fe792044279124a5e298a697897e99df0dd83f7c51d6bee295b447810531d

  
Dropping
MD5 ed856da620bee13a4e1641f4d4eda567
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 194fe792044279124a5e298a697897e99df0dd83f7c51d6bee295b447810531d

Comments