MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d
SHA3-384 hash: 67647601578f8ae12c974f584cc2282b9cdc4c5ef4385987e677367bd8ff7ebe965b4b6106171b1d01d93cb69b9b9505
SHA1 hash: 960d8ab604074ae949830ec1ec895780428a600f
MD5 hash: b49b6db07fb1a40bd3dae0f96e666be7
humanhash: mockingbird-fanta-twelve-blossom
File name:Purchase_order_Project_1489938202.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-05 11:38:35 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:hsQ5xGH4VY98FLK2JI1PBrn3ziGyWqxw9CtoSjIOQ60d:u8GH4TFenz3ziXFw0toSjIOQ
TLSH FD45F11032E85B11D8F6A7FA1934C11443BA3A463273E38D9DD9B1DE2EB5F104A25F6B
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sellerbulknewspoint.live
Sending IP: 202.75.32.30
From: Sam <info@sellerbulknewspoint.live>
Reply-To: charrntide6@gmail.com
Subject: Purchase Order-Urgent!!!
Attachment: Purchase_order_Project_1489938202.img (contains "Purchase_order_Project_1489938202.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-05 06:07:31 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7dpyyiaw65dlyodm27efkc5z53y3fjjutfqpum6744ngpb62qkgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d

(this sample)

AgentTesla

Executable exe 20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff

  
Dropping
MD5 ab3090feea21d2817c6afdadf06fe6a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff

Comments