MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25ff617424cc6aacabca49d2f8bc71245fd28dc0acf0a26ea6192699d1322246. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25ff617424cc6aacabca49d2f8bc71245fd28dc0acf0a26ea6192699d1322246
SHA3-384 hash: 243ce950cd6473b606c3e2e8f1fcf24fd4b990f3b7288f09f5f459d5b966fb08f225e801b607e6be380ae6fef40d1d71
SHA1 hash: edfc33458c9101f95cf01fe055de047f2f35a221
MD5 hash: 7a228f182a0ef8c96394ca08baa84562
humanhash: triple-venus-friend-may
File name:PO1909003 India.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:602'112 bytes
First seen:2020-08-06 04:43:56 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:MQfir1UW1L24u31IckbpVQWabDLkjBUGkmQQSFwWQjRH:jfir1UW1LajkdVoDyOG3cwWQjRH
TLSH 7CD4BF3162946F65E43DA7BD94202500B3F2E657D322FA8E7DBC40DF1A97F814B62A13
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: supergas.com
Sending IP: 156.96.46.79
From: srividya@supergas.com
Subject: 答复: tool inquiry
Attachment: PO1909003 India.iso (contains "PO1909003 (India).exe")

AgentTesla SMTP exfil server:
webmail.mrconsult-kw.com:587

AgentTesla SMTP exfil email address:
badawi@mrconsult-kw.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43601243.22978.23338.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25ff617424cc6aacabca49d2f8bc71245fd28dc0acf0a26ea6192699d1322246/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 04:45:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/25ff617424cc6aacabca49d2f8bc71245fd28dc0acf0a26ea6192699d1322246

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 25ff617424cc6aacabca49d2f8bc71245fd28dc0acf0a26ea6192699d1322246

(this sample)

AgentTesla

Executable exe 74a4f01410127eb8a0cbfaaf9f8c60eb31bf8aad55599ba514d6ef02c9f660ff

  
Dropping
MD5 14e521e9de293f346c84d6ce637a3b1b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74a4f01410127eb8a0cbfaaf9f8c60eb31bf8aad55599ba514d6ef02c9f660ff

Comments