MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546
SHA3-384 hash: 9534f521ba1a41df9a936206756e9bd417bd6560fdaf9450473cd7925d2085108ae9bb3b9c84c05cf35264d199f9df11
SHA1 hash: 8658da993fdeb62eb63947d266bfce3acae0f208
MD5 hash: 2bc8b26223deea9ce8106d1282f57079
humanhash: robert-beryllium-grey-hamper
File name:Purchase Order 38732.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:958'464 bytes
First seen:2020-08-04 09:04:38 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:0ONE5bcPgYxmOy+2Do4pPeRH89fE+Bqc4lqZrw3DfZdeu1rHbsrxQDVnJ+L3:0+HIYxPYVZl/j7O313wxAV
TLSH D615AEC5F5409A59DC1A4D3B89325C914B33AC6BEF06D207708CB6996BBB1C76F24B83
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zmail.rfvallianz.com
Sending IP: 203.177.117.142
From: sales05@rfvallianz.com
Subject: PURCHASE ORDER
Attachment: Purchase Order 38732.iso (contains "Purchase Order 38732.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.3318.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 09:06:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=duocf5dv54bpkont3rhrb7sqwibjap5kg6penpyhny3crdnrkvda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546

(this sample)

AgentTesla

Executable exe 5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9

  
Dropping
MD5 43fe85d87b7a3ff5d1cd68d540b2b18c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9

Comments