MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2275231ed4a40318282d4d56d61c78057e4b69e98c630590ebd02bc26fef4565. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2275231ed4a40318282d4d56d61c78057e4b69e98c630590ebd02bc26fef4565
SHA3-384 hash: a885ff869a03f99a0930fe03664b59c6b531a13eaec96012f157e1d9b9e9939dab8da7a65fe1d4945ae7a19a27312eca
SHA1 hash: 5542077dfbad51c94f6c664be82c04b1c49bad02
MD5 hash: 7b1969aaf6533981b63cf71f5ace5242
humanhash: alabama-oven-south-king
File name:CV-JOB REQUEST______pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:692'224 bytes
First seen:2020-08-27 08:59:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:yaFJdnrjSTXgjD63uakwXX5bY9aYWlTgSgL1Sy6wIezhYahlqNPgoYfRH:GgDIdX5waBa1SDah2m
TLSH BAE4126413BD8F09F6FD4AF968BE311003B238956475E34AB94DE2A86FF37804951B63
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: omsairamlogistics.com
Sending IP: 49.248.66.174
From: Nitheesh Thomas<anantapur@omsairamlogistics.com>
Subject: CV-JOB REQUEST
Attachment: CV-JOB REQUEST______pdf.iso (contains "CV-JOB REQUEST______pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.409.340.13042.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2275231ed4a40318282d4d56d61c78057e4b69e98c630590ebd02bc26fef4565/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 09:02:23 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ej2sghwuuqbrqkbnjvlnmhdyav7ew2pjrrrqlehl2av4e37pivsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2275231ed4a40318282d4d56d61c78057e4b69e98c630590ebd02bc26fef4565

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2275231ed4a40318282d4d56d61c78057e4b69e98c630590ebd02bc26fef4565

(this sample)

AgentTesla

Executable exe e43e6c7ed4d0d2b6d30aedbb521203643e74511582425c6640cd2fd66f5ed6c8

  
Dropping
MD5 75351200ca48b35c53d5f44b7d01cdeb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e43e6c7ed4d0d2b6d30aedbb521203643e74511582425c6640cd2fd66f5ed6c8

Comments