MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a32310ddb24be3a36007d99bc7e5dc3422e90a288aa22b3ac90e14cff80b0c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a32310ddb24be3a36007d99bc7e5dc3422e90a288aa22b3ac90e14cff80b0c1
SHA3-384 hash: 1f991b3b184313698ea7044d3ff860167d3f609c2f64381764b9cedcd04896a6959d24cdcf16b388aefe061437b7164d
SHA1 hash: 8f5d05e96a8830d834a9ad9f95404a80ff125ac5
MD5 hash: 05db4bb2a658721b2dc4d1e88c3ed6bc
humanhash: magazine-missouri-victor-november
File name:2598_MSC_ NEW_ORDER07_21_2020_LE_,pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:655'360 bytes
First seen:2020-07-21 06:36:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:oXjflg5eurSyRw6TBNL0+TCrVG3QqsdPkl+giQIZlQNJjP8WVahbLYZNF:/z/92hGgbitdaQ/P8WqfYZ7
TLSH 1CD46B50E3B849D9E37B17B8D47550104372BA1AA7EAD30D2B99F1AD0A333128763F97
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corporate.orangemali.net
Sending IP: 197.155.141.42
From: Bill Hwang <york@hzyuding.com>
Subject: New Order
Attachment: 2598_MSC_ NEW_ORDER07_21_2020_LE_,pdf.iso (contains "2598_MSC_ NEW_ORDER07_21_2020_LE_,pdf.exe")

AgentTesla SMTP exfil server:
server03.imanila.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a32310ddb24be3a36007d99bc7e5dc3422e90a288aa22b3ac90e14cff80b0c1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:38:06 UTC
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bizdcdo3es7dunqapwm3y7s5ynbc5efcrcvcfm5msdquz74awdaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a32310ddb24be3a36007d99bc7e5dc3422e90a288aa22b3ac90e14cff80b0c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 0a32310ddb24be3a36007d99bc7e5dc3422e90a288aa22b3ac90e14cff80b0c1

(this sample)

AgentTesla

Executable exe f106c0e340d4fb92717d3ec2fd4e1c928155b3faa06aa8f4b98e9596cb5d401f

  
Dropping
MD5 3b06a1d8542024e43de4be354321c0ce
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f106c0e340d4fb92717d3ec2fd4e1c928155b3faa06aa8f4b98e9596cb5d401f

Comments