MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f7bd9c9795621ad0244fd614d8e79e332145227786a33f02bbeb8e74acddf39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f7bd9c9795621ad0244fd614d8e79e332145227786a33f02bbeb8e74acddf39
SHA3-384 hash: 952274770e76150451b2af4756f57893fe3768756f8841a96965444673f9e710bf055dd561e808ffb91bd68ea3949074
SHA1 hash: 7dacb43b32cdc08b026e3187e7490590dda607d7
MD5 hash: 4cef0d38c8517ccf275c44f72b3566ea
humanhash: sink-march-mango-papa
File name:Purchase Order BP2000905.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:954'368 bytes
First seen:2020-07-08 06:25:58 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:pBE6523ZLGdSgQ9DVrQRJVANdTZqPmBLfmBqG0Y024tMoIT+WhhKlXwsHZ/WNNxt:pBiGVCJdGV5slhtWUslhtWS
TLSH 4015D131BBB59902D73A4F36D86301109EFB79676E06F69B2ECC24EE0997B441943B07
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: SD84.btc-net.bg
Sending IP: 212.39.90.84
From: dbt808@mbox.contact.bg
Subject: FORTUNA PURCHASE ORDER
Attachment: Purchase Order BP2000905.iso (contains "Purchase Order BP2000905.exe")

AgentTesla SMTP exfil server:
smtp.multilprollc.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.HEUR.QVM03.0.6BCA.Malware.Gen.27071.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f7bd9c9795621ad0244fd614d8e79e332145227786a33f02bbeb8e74acddf39/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:27:04 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b555tslzkyq22ase7vqu3dtz4mzbiurhpbvdh4blx24ooswn344q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 0f7bd9c9795621ad0244fd614d8e79e332145227786a33f02bbeb8e74acddf39

(this sample)

AgentTesla

Executable exe cb1927e26dcf4dc646884e37de470cf002be82095aa7b6d1d4230f78c34b26ca

  
Dropping
MD5 69a1b2134ce94b111bd90d9cf551e54d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb1927e26dcf4dc646884e37de470cf002be82095aa7b6d1d4230f78c34b26ca

Comments