MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec173736b54bc2f4c5572072687948624400f5c1cf742ef6f629af040711ba3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec173736b54bc2f4c5572072687948624400f5c1cf742ef6f629af040711ba3d
SHA3-384 hash: be2a1a7e94a6347d4c4ad69cf366eec14a877f9fd88d5f9b5f62d3cc093cf2192263f183f9ec1c4233e2457b82163f73
SHA1 hash: 9cfc674c0363a26b1915b5a07f5e8a88f5cf7d0a
MD5 hash: df3ef3f39103f1a858a5d7ff7e11fb51
humanhash: delta-xray-beer-uncle
File name:IMG_20201103_00184197413227348173.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:546'816 bytes
First seen:2020-11-06 07:37:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:4V02NY8QFhe7IaxZni4V2i6xFF17NaXs+inEAmD:4eyaza3FN6r7Ssl
TLSH D5C48EF871195C95F52F463699A9BDA402B33E53CACBA84C62ACF65317F3362BD0180D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smarthost1.orion.rs
Sending IP: 77.105.0.34
From: Massimiliano Melloni <mellonei@tecno-gru.it>
Subject: INQUIRY
Attachment: IMG_20201103_00184197413227348173.img (contains "IMG_20201103_00184197413227348173.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec173736b54bc2f4c5572072687948624400f5c1cf742ef6f629af040711ba3d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 01:40:03 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qltonvvjpbpjrkxebzgq6kimjcab5obz52c55xwfgxqibyrxi6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ec173736b54bc2f4c5572072687948624400f5c1cf742ef6f629af040711ba3d

(this sample)

AgentTesla

Executable exe 96f626870e2520e8a59b54ba0b232dad58f1a66942781c9b3951a6b1cab29b0c

  
Dropping
MD5 c1aabe13455e27d795b57846c15bc002
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96f626870e2520e8a59b54ba0b232dad58f1a66942781c9b3951a6b1cab29b0c

Comments