MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6999ae15135370c64c8aa367947b6abf27f91c514817fcf2d8bee86a0c6fce8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6999ae15135370c64c8aa367947b6abf27f91c514817fcf2d8bee86a0c6fce8
SHA3-384 hash: ca66cf7baf7cf0e45e8a2f1c42c8809b55774a98ebd3205218866d0b12cd7f9d8a51dcb44aa479f6d801a121b261ab89
SHA1 hash: 467b2564e23de4ae9407717dd35d48612e91fb1b
MD5 hash: 3482c33c11a1720b4e6ee71e4396c0e7
humanhash: football-beer-yankee-romeo
File name:INQUIRY637_NEW.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-11 08:47:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:2qfCtk3cOaX0ilegG0/pJp3bFlhtvfXp8gznf7tI6Iom:2qfCtk3cOaX0ilfRJ1hlD58gDZNIom
TLSH B3458C4022BD9F2AE0B66BF31AA4B441DFB96C163416F76D5DD530CA4AF4F41C8A0E27
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dr.com
Sending IP: 193.169.52.159
From: Jessie <bors.lubing@dr.com>
Subject: Re: RE: Inquiry #637
Attachment: INQUIRY637_NEW.IMG (contains "INQUIRY637_NEW.exe")

AgentTesla C2:
http://193.169.52.202/image/images/news/tax/pictures/news/inc/28e4bee586d0b8.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45506.32451.24119.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 03:01:00 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
12 of 31 (38.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=62mzvykrgu3qyzgivi3hsr5wvpzh7eofcsax7tznrpxinigg7tua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f6999ae15135370c64c8aa367947b6abf27f91c514817fcf2d8bee86a0c6fce8

(this sample)

AgentTesla

Executable exe 6cacde1306c8b9679db400be31f29a78ee62875f4047d3855b8ceb8dc4019eb1

  
Dropping
MD5 a97974ba408a2cfb46b13847762e71a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6cacde1306c8b9679db400be31f29a78ee62875f4047d3855b8ceb8dc4019eb1

Comments