MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddda7502ff40161b664386bdd1795976e6969acfcf8f37ee46b49a1b56a3f275. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddda7502ff40161b664386bdd1795976e6969acfcf8f37ee46b49a1b56a3f275
SHA3-384 hash: 395dd6405b8d9567307355107a9550a307377e6eaebe438db045fd327ffcf88b8a018969cacb52867ed501964ed52090
SHA1 hash: c19b4f58f226d928877949e030aed308d3011ab7
MD5 hash: 79c1bfc2aef9bcd6e2ce0d9b3df694f4
humanhash: seven-network-romeo-alabama
File name:Wire Transfer MT103 Overdue Invoices Payment.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-20 08:58:10 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:soxtLQ+SM/E+f8SzAmWeTyCREZErp/z6JnIYEYDQco30hzWRlRGUzt:rfLQ+lz8+RRTyCu06JnIYj7BWRP
TLSH 274512847528B15BD26E05F610E02501D73897928762FBC53ECC16E64BF7BE8CA067EB
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ap.apiholiday.live
Sending IP: 45.95.171.184
From: Cynthia Mead <info@apiholiday.live>
Subject: Fwd: Wire Transfer MT103 - Overdue Invoices - Payment requested paid
Attachment: Wire Transfer MT103 Overdue Invoices Payment.img (contains "Wire Transfer MT103 Overdue Invoices Payment.exe")

AgentTesla SMTP exfil server:
smtp.adenerqyeurope.co.uk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 09:55:44 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xnhkax7ialbwzsdq265c6kzo3tjngwpz6htp3sgwsnbwvvd6j2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ddda7502ff40161b664386bdd1795976e6969acfcf8f37ee46b49a1b56a3f275

(this sample)

AgentTesla

Executable exe 70e4aa516e9ac63bd4c4e4be1735ff75d250425fb7635f4267242d6798d35827

  
Dropping
MD5 0757aadb057c1c88f95b44a31243a277
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70e4aa516e9ac63bd4c4e4be1735ff75d250425fb7635f4267242d6798d35827

Comments