MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1848dbceda61c8d668f4bdd658a0ae6e3b3eb3ee818948459fa068c00ec487f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1848dbceda61c8d668f4bdd658a0ae6e3b3eb3ee818948459fa068c00ec487f
SHA3-384 hash: 076211c5fad3f49c33df5dd4138e48b6b9574ab2e109cdb28194d7efa57461517fffa1479392f464ab52250cd984548a
SHA1 hash: 21a88831d95d6cc7a76571916b6b0125f723a799
MD5 hash: d7aaa290bc9f7a7bb6bef28579e3c24a
humanhash: north-london-ink-west
File name:Payment_Forms 289048.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'507'328 bytes
First seen:2020-08-17 18:43:39 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:AN1oS1QbvgWK5WpLverj1ZKYyR0ha7QAEVPg1b8qwHy3mxfTxQ8w:oQbvxaWFe3uYyR0ha7oPg1Z+YmNS
TLSH F465172939826E19D63E063010A49692F373AD863E91C75F76DF4BCC7F0258B2B9605F
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: c7030220.vservers.es
Sending IP: 91.142.209.132
From: Agricola Livon <bogachdds@gmail.com>
Subject: FYI. PAGAMENTO DELLE FATTURE
Attachment: Payment_Forms 289048.img (contains "87041032.pdf.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1848dbceda61c8d668f4bdd658a0ae6e3b3eb3ee818948459fa068c00ec487f/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 10:03:38 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6gci3phnuyoi2zupjpowlcqk43r3h2z65amjjbcz7idiyahmjb7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f1848dbceda61c8d668f4bdd658a0ae6e3b3eb3ee818948459fa068c00ec487f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f1848dbceda61c8d668f4bdd658a0ae6e3b3eb3ee818948459fa068c00ec487f

(this sample)

AgentTesla

Executable exe be732f090df2d1d81a25d0b42d6be124db61f3854fffc5f42c2294d80a83bd95

  
Dropping
MD5 63d94af08d7731b8358465d266dc9993
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be732f090df2d1d81a25d0b42d6be124db61f3854fffc5f42c2294d80a83bd95

Comments