MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1673be4610bf44f3c6e4820c16156e259e8c2c58ff896ca48b950b72a69809d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1673be4610bf44f3c6e4820c16156e259e8c2c58ff896ca48b950b72a69809d
SHA3-384 hash: fd6cff02cbfa18643a2eb136e6f33555fe519d5dbf01b41557f191126411d700ea421560ae508ecb448897608912b9a5
SHA1 hash: 816f9d5503abcfb49a709e0f55036dda0a55ad1b
MD5 hash: 2daed9cc1ed281a7c5544cba81cb807e
humanhash: neptune-cup-nitrogen-fix
File name:ORDER...08302020.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'703'936 bytes
First seen:2020-08-30 11:41:04 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:9LfExXuW7+YQhY5HHS9SMBsswpKKwU0ySGr78JFkroICXyk1mXbAlHozadpGIZsl:9LpDY5SZBsTp9pvd82BC/1KeOa7
TLSH 39758C893304739EC817F93699541CA8EA707D66D72BD283DC1B31A8993D59FEF180E2
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Al Misfat Equipment Company LLC <info@almisfat.com>
Reply-To: info@almisfat.com
Subject: RE: RE: order query ! / new order 30-08-2020 . / Order # DSPO 190828A
Attachment: ORDER...08302020.IMG (contains "aAz6J4ZdUpY0h3s.exe")

AgentTesla SMTP exfil server:
mail.cka.com.sg:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.6681.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1673be4610bf44f3c6e4820c16156e259e8c2c58ff896ca48b950b72a69809d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f1673be4610bf44f3c6e4820c16156e259e8c2c58ff896ca48b950b72a69809d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f1673be4610bf44f3c6e4820c16156e259e8c2c58ff896ca48b950b72a69809d

(this sample)

AgentTesla

Executable exe 09a679d1450e2d295c84e1334ae54e238d07f49e3d0b4f3a1d487e1a3da0ea2f

  
Dropping
MD5 8ab069dc4d6c9dd6dc76c3a6c6eba17c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09a679d1450e2d295c84e1334ae54e238d07f49e3d0b4f3a1d487e1a3da0ea2f

Comments