MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 118444fcda21635f0638b156943a02e579058df2d551c45960874b1c3f81f0db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 118444fcda21635f0638b156943a02e579058df2d551c45960874b1c3f81f0db
SHA3-384 hash: db3fc3ae2f368a057ce11a24f59701c939b0e454a038ed21a4543b6677e6d1bcfad5488c11bc94a56dbc83d66cd0d97d
SHA1 hash: 417e1547e59e28ad4e7f5654c3082d26934306b6
MD5 hash: b2a3a8615d7d89b467ab1858003deee8
humanhash: vegan-mockingbird-bravo-charlie
File name:Items request on this Enquiry list.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:718'848 bytes
First seen:2020-08-28 06:29:51 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:yv9I2SMrjx42rmDxSKiP8B1c8GVRM/yRIiNUqe/eO5YKD1sXtQkjDd:C4Mrjy2rmdSKiP8Bu/PUCk5YKetT
TLSH 14E4D53D3EC29A25D92D063204F85AE67771B5473A52CF1FBACB078C5F0269B3B16186
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.cnexac.tk
Sending IP: 165.232.57.254
From: Ketrina Cheng <info@cnexac.tk >
Subject: Items request on this Enquiry list
Attachment: Items request on this Enquiry list.iso (contains "Items request on this Enquiry list.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/118444fcda21635f0638b156943a02e579058df2d551c45960874b1c3f81f0db/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 06:31:06 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cgcej7g2efrv6brywfljioqc4v4qldps2vi4iwlaq5fryp4b6dnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/118444fcda21635f0638b156943a02e579058df2d551c45960874b1c3f81f0db

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 118444fcda21635f0638b156943a02e579058df2d551c45960874b1c3f81f0db

(this sample)

AgentTesla

Executable exe e3854025455792e894025cff4108978ce383570b7c5361cafcc0dfbff6e29fc0

  
Dropping
MD5 515b3d1a0aec18593f7bf8fa756763a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3854025455792e894025cff4108978ce383570b7c5361cafcc0dfbff6e29fc0

Comments