MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd718735244c7dd3af62c0367881478ee5f0a1b4fa7e236a68600eb19a277b65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd718735244c7dd3af62c0367881478ee5f0a1b4fa7e236a68600eb19a277b65
SHA3-384 hash: 101b756231bfcb3bcac32bba4c82e94597e5e900c3bcb420bffab20912946cbc53645d54e3321868e6dbd578d0e74132
SHA1 hash: cff5555fc0a3e7879cbee4b0b055f2d61f593438
MD5 hash: e1981c15f849bbae79749e35c4a9bb14
humanhash: wisconsin-asparagus-sodium-berlin
File name:P.O 7003207 ADAC-US.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-11-18 06:39:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:WkPAtlj3XUog+pht8LFOcc6WkFREIpEqynK3/tkpcoQSt8bqZCoW4Wki9WwzRm:CTpv8bWkbEIpunEKpFZb2fk
TLSH E055E0312665BF92D67D0BF48161A4450FF96A2B642CE39C3CD921DF26B1F094E02DBB
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Jonas Navickas <mmahmed@kisr.edu.kw>" (likely spoofed)
Received: "from server1.rahaworld.com (server1.rahaworld.com [196.41.32.18]) "
Date: "Wed, 18 Nov 2020 04:52:10 +0300"
Subject: "FW: P.O 7003207 ADAC-US"
Attachment: "P.O 7003207 ADAC-US.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader35.51022.3873.23103.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd718735244c7dd3af62c0367881478ee5f0a1b4fa7e236a68600eb19a277b65/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 01:30:55 UTC
File Type:
Binary (Archive)
Extracted files:
30
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vyyonjejr65hl3cya3hrakhr3s7binu7j7cg2timahldgrhpnsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img fd718735244c7dd3af62c0367881478ee5f0a1b4fa7e236a68600eb19a277b65

(this sample)

AgentTesla

Executable exe 29606f35cd9ea80936304ef255b1962b8ba4e20a97e40cadabb37da6785c0ff9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29606f35cd9ea80936304ef255b1962b8ba4e20a97e40cadabb37da6785c0ff9
  
Dropping
AgentTesla

Comments