MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9dfd3074e6496ad579aaafd30283dd2921631e61ea4d4289774f1902370117e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9dfd3074e6496ad579aaafd30283dd2921631e61ea4d4289774f1902370117e
SHA3-384 hash: 3577ed908070a31265938e460673b4019f7b06c79f7493806ab6db6f0d33b8da2902215271de2f00904163e416547d67
SHA1 hash: 12c7d6e06cc2fe8a4591975fbe0b4dc3ac0ae1f1
MD5 hash: 363b4500e3995917a0efee84e8a5253a
humanhash: whiskey-july-beryllium-sad
File name:CNFLQ 000040820202084264138_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:538'624 bytes
First seen:2020-08-04 13:21:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:liqIRdFqODhxTkWNJqBtcNBZzAZu6to+:kqIRdcqpkWTOwZzD+
TLSH F0B49D80B03729A3DBB993F5160231108BB2231E79EEE2E15DCED5C752DAF491952B37
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dynamica-k2mail.all3.it
Sending IP: 213.187.10.56
From: Evangelos Kakatsos <ekak@intracom-telecom.com>
Subject: new order 4800041637
Attachment: CNFLQ 000040820202084264138_PDF.img (contains "CNFLQ 000040820202084264138_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9dfd3074e6496ad579aaafd30283dd2921631e61ea4d4289774f1902370117e/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 12:03:29 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5hp5gb2omslk2v42vl6takb52kjbmmpgd2snikexotyzai3qcf7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e9dfd3074e6496ad579aaafd30283dd2921631e61ea4d4289774f1902370117e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img e9dfd3074e6496ad579aaafd30283dd2921631e61ea4d4289774f1902370117e

(this sample)

AgentTesla

Executable exe 6ff29c14c56cbe768cd5674a752b8be053a3ce8d80f4cf0ab58bcd266ca1297d

  
Dropping
MD5 e0e894c3eaf21f59a4b42f5c8337b7b0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ff29c14c56cbe768cd5674a752b8be053a3ce8d80f4cf0ab58bcd266ca1297d

Comments