MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fea74e84d0798d828ff3870103092fbdaf131bb56ecd1c82dd98fc9ab2a89038. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fea74e84d0798d828ff3870103092fbdaf131bb56ecd1c82dd98fc9ab2a89038
SHA3-384 hash: 20d8b86109b5daeaf49fd0026ae0075623741e96ffd055c05eac3470614ac5d17eeeafe3db6b220c51f444fe58053164
SHA1 hash: 64f6db84bf5327a469f4420a5bada96de27f7d70
MD5 hash: 4bcbe742abd609f3f60062092f299ce6
humanhash: double-illinois-dakota-monkey
File name:Our New Order August 17 2020 at 2.77_PVV440_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-18 19:45:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:dP2eYNGdC7xRXoEoJpG1n6wYpmfzL2TjYwNcBvY3qbQMXThs:JJw7xT4E1n6PmzL2HBOXX2
TLSH 8745230AA0D8CAF1CB957D3FE02937212330FF1B9553E89F748DDB25AF65A81629205D
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.net-access.net
Sending IP: 51.254.138.129
From: Jana Azih <jana.azih@getinge.com>
Subject: RE: AW: Our New Order/Enquiry No.00127
Attachment: Our New Order August 17 2020 at 2.77_PVV440_PDF.img (contains "Our New Order August 17 2020 at 2.77_PVV440_PDF.exe")

AgentTesla SMTP exfil server:
mail.beljemi.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.7c7e58852d000bd3.15428.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fea74e84d0798d828ff3870103092fbdaf131bb56ecd1c82dd98fc9ab2a89038/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:47:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=72tu5bgqpggyfd7tq4aqgcjpxwxrgg5vn3grzaw5td6jvmvisa4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/fea74e84d0798d828ff3870103092fbdaf131bb56ecd1c82dd98fc9ab2a89038

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img fea74e84d0798d828ff3870103092fbdaf131bb56ecd1c82dd98fc9ab2a89038

(this sample)

AgentTesla

Executable exe 140831c456eb79b85764ffe241d69f5c01b83af5ca6f124a8f9ef9399e0b648c

  
Dropping
MD5 7c7e58852d000bd3320428d373341a9e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 140831c456eb79b85764ffe241d69f5c01b83af5ca6f124a8f9ef9399e0b648c

Comments