MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aac6c51f4f0de99fd522917da76eb13b64203b128fc4ce130a4aabbfb7954aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aac6c51f4f0de99fd522917da76eb13b64203b128fc4ce130a4aabbfb7954aa
SHA3-384 hash: ec5287ff18a5334928c695e4560650c7b79332eb1eb0bd66afe4e0a56bceb5c588cd41308fdc286baf7367bec24ebef1
SHA1 hash: 88db78efc051f541a4a8141b5dc854c5647c474e
MD5 hash: 93ed5f1c2b8b7cd90d366173cfa1c3fc
humanhash: six-sierra-enemy-wolfram
File name:RFQ. 07032020. pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-03 15:19:30 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:WrZUkr7pGYSFnz7kQQiNFTD/aSd3G6g+9t4wRr/CxiIeAsE1nFKRPiw5HWKCkCxg:WVUCpG3gWX/aSd3xg6t4wUxkAAl//t
TLSH 464548027EDEED14DDF682FE0D818F76CE6E74EE502181F9398CB2991521B604ED864B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail-smail-vm47.hanmail.net
Sending IP: 203.133.180.235
From: TMC (최 병 현) <this11c@hanmail.net>
Subject: RE: Re: RFQ. #07032020
Attachment: RFQ. 07032020. pdf.iso (contains "RFQ.07032020.pdf.exe")

AgentTesla SMTP exfil server:
smtp.mail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Strictor.109508.12490.13688.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aac6c51f4f0de99fd522917da76eb13b64203b128fc4ce130a4aabbfb7954aa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 15:21:05 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkwgyupu6dpjt7ksfel5u5xlco3eea5rfd6ezyjqusvlx63zksva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 1aac6c51f4f0de99fd522917da76eb13b64203b128fc4ce130a4aabbfb7954aa

(this sample)

AgentTesla

Executable exe f3b81fe8022344fd599e5e45187f2a0f6100bb3b4135fcfa99912112bf129af7

  
Dropping
MD5 13a13b2959a41a5cc539eaf342c68b9a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3b81fe8022344fd599e5e45187f2a0f6100bb3b4135fcfa99912112bf129af7

Comments