MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12a9296bbae006899ed14d94a52cdd92853798ae302b83ba57375642e53f2929. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12a9296bbae006899ed14d94a52cdd92853798ae302b83ba57375642e53f2929
SHA3-384 hash: 909b79c230324326c58838327861df06b21d1042d5a6e6c226cc1c0b3ee373640b266ec5d4c4276d3a787c2bbbadc9ea
SHA1 hash: 9f27b017b8bdbb72a168fccc2d3b56d79998fce4
MD5 hash: abb5e57d3065709c03973c9f31441a0a
humanhash: connecticut-friend-oranges-pennsylvania
File name:INVOICE.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:669'696 bytes
First seen:2020-08-31 10:48:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:wezwXEXhYukdKxUwpE7afjf3laW9YxBnt2hJBo5AXDsY+zHLDiDC60hp7o6T+oN5:XpYukA3E+73laW9otViDsYw
TLSH 02E4122026FC4F2AD6F21EF6005D3899A37368A14C6DD68F78DD329617B77A98315B03
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: idrsystem.co.kr
Sending IP: 95.211.208.25
From: mkhong@idrsystem.co.kr
Subject: [EXTERNAL] Outstanding Invoice Theory
Attachment: INVOICE.iso (contains "INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12a9296bbae006899ed14d94a52cdd92853798ae302b83ba57375642e53f2929/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 03:13:17 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckuss2524adithwrjwkkklg5skctpgfogavyhosxg5lefzj7feuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/12a9296bbae006899ed14d94a52cdd92853798ae302b83ba57375642e53f2929

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 12a9296bbae006899ed14d94a52cdd92853798ae302b83ba57375642e53f2929

(this sample)

AgentTesla

Executable exe 1df1597314ab01b00a84f5a025cb5112828d20fbc59dd3098fcb45fb88534661

  
Dropping
MD5 cdf5b175db3a7b60a0734daf15364717
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1df1597314ab01b00a84f5a025cb5112828d20fbc59dd3098fcb45fb88534661

Comments