MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f16c64acfac1db158f78bb252bbcb0dc480a3f821bf8ca7f1c81447f47f879aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f16c64acfac1db158f78bb252bbcb0dc480a3f821bf8ca7f1c81447f47f879aa
SHA3-384 hash: 1ec4803746e54969884e044342b7f3d0e4014d528bdb9a92c7794657da7d56d7fbe7a67bd4eb8fa53df22573c63c1883
SHA1 hash: d7d66146cbae4808dc9bdfa614af2ab16ee3516a
MD5 hash: a701e4d8d47797377ff36414889958b6
humanhash: nuts-montana-oven-skylark
File name:Transfer Form.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'572'864 bytes
First seen:2020-07-08 06:45:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:tGwSuYh0wtkYQfo2GDspslhtWEslhtWj0:pa0qQtA1htWphtW
TLSH 1975CFB0B7A1D601C77B0E35D87381125EB6655F5E0AE28F2DE876AE0D633481947F0B
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: PAYU TURKEY <enquiry@oxy99.in>
Reply-To: PAYU TURKEY <account@payu.com.tr>
Subject: INCORRECT BANK DETAILS FOR PAYMENT
Attachment: Transfer Form.img (contains "Transfer Form.scr")

AgentTesla SMTP exfil server:
mail.northwestpowdercoating.co.uk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f16c64acfac1db158f78bb252bbcb0dc480a3f821bf8ca7f1c81447f47f879aa/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:47:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fwgjlh2yhnrld3yxmssxpfq3reaup4cdp4mu7y4qfch6r7ypgva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f16c64acfac1db158f78bb252bbcb0dc480a3f821bf8ca7f1c81447f47f879aa

(this sample)

AgentTesla

Executable exe d5434b833a6b29c1f83aee2a0c8c5584467e495e452f7e6e676235b7e4870033

  
Dropping
MD5 de18b7e07da179adb8c5c3be4698f2be
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5434b833a6b29c1f83aee2a0c8c5584467e495e452f7e6e676235b7e4870033

Comments