🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff7dcee8d565701b438bf1113e33d6f5e9210fb260706c29b5b5de1584cea5b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff7dcee8d565701b438bf1113e33d6f5e9210fb260706c29b5b5de1584cea5b2
SHA3-384 hash: cab1c8b04cafe023bec1b8cda1ba1e96176a28cf152e1280d08df5d8d88f7743f6cdf8a4205dd5fe3b624ca502611059
SHA1 hash: 93c40d2ff2d1b25b3b0d75efda929b610225e25e
MD5 hash: 2e9a342fc54c7d055cf97531a82d3996
humanhash: magazine-apart-cardinal-music
File name:Ref 20194090250.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-26 06:08:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Or5HmQGCpxKRwFjwjQ5brxaayhRqU6IdASVZbc8CYOnSmsl+wLCo9F1S1:qfXpw4JR+RH28RCYOSJl+W9nS
TLSH 4C451292568CE726DAEC0FB829DD320113F4895B55F4E709B98FE3D513EAF60A0426C7
Reporter abuse_ch
Tags:AgentTesla Endurance img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: OXY99 INC <enquiry@oxy99.in>
Reply-To: OXY99 INC <enquiry@oxy99.in>
Subject: Enquiry
Attachment: Ref 20194090250.img (contains "Ref 20194090250.pdf")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FYVFC4DB2D0CDD3.16994.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff7dcee8d565701b438bf1113e33d6f5e9210fb260706c29b5b5de1584cea5b2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-26 06:10:06 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=756452gvmvybwq4l6eit4m6w6xuscd5smbygyknvwxpblbgouwza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/ff7dcee8d565701b438bf1113e33d6f5e9210fb260706c29b5b5de1584cea5b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ff7dcee8d565701b438bf1113e33d6f5e9210fb260706c29b5b5de1584cea5b2

(this sample)

AgentTesla

Executable exe 9de2cc14a4864bc03b4460f855157ea4c443bb7425d7af67ecb00bc3ec6f209d

  
Dropping
MD5 fc4db2d0cdd3eb628cc6a3f85ed044a0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9de2cc14a4864bc03b4460f855157ea4c443bb7425d7af67ecb00bc3ec6f209d

Comments