MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0da93de6232ccf01d3a286c03e2a3938876b6ea09cce0400e7139694588ff5a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0da93de6232ccf01d3a286c03e2a3938876b6ea09cce0400e7139694588ff5a0
SHA3-384 hash: 6dda383eb6ae092c6ad0b3097b8a8a772f35cd802e00c35207a7a02135e360b6dc62dd947e6980d36d9691d4cc9dac05
SHA1 hash: edbe14b4fd42b775e3cde7aefdb23c9cba070b81
MD5 hash: 2980544e0522a6d082198ba1bc4c1a00
humanhash: sad-carpet-lactose-lactose
File name:Q3364290.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:509'952 bytes
First seen:2020-08-05 09:31:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:6eAhh9syItX0cek4NICMO2YIL1okecdytCfc8:6eAhvItkc14WCMObI2rqyv
TLSH 76B4DF0C3A85994AF1BA4E3FAC7001839E22F45FD931D60B7ABD116A477F65CAC61F60
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gokduman.com.tr
Sending IP: 95.211.208.41
From: Vinod kumar<gokduman@gokduman.com.tr>
Subject: RFQ-- ENQUIRY - BMR Trading Ltd
Attachment: Q3364290.iso (contains "Q3364290.exe")

AgentTesla SMTP exfil server:
smtp.ociii.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.23733.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0da93de6232ccf01d3a286c03e2a3938876b6ea09cce0400e7139694588ff5a0/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:32:25 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwut3zrdfthqdu5cq3ad4krzhcdww3vatthaiahhcoljiwep6wqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0da93de6232ccf01d3a286c03e2a3938876b6ea09cce0400e7139694588ff5a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 0da93de6232ccf01d3a286c03e2a3938876b6ea09cce0400e7139694588ff5a0

(this sample)

AgentTesla

Executable exe 4ae68d2c88df4061559e363819ef80cc2e3edc851fa74c5712a342ff99d06da7

  
Dropping
MD5 62ac8026221e4f4c3708d7ec7126160f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ae68d2c88df4061559e363819ef80cc2e3edc851fa74c5712a342ff99d06da7

Comments