MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28f616fb0566e21d7fbaedf1916421502b64a7d88667399da3f22f53a3f23f73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28f616fb0566e21d7fbaedf1916421502b64a7d88667399da3f22f53a3f23f73
SHA3-384 hash: c15f8fa8fbf435390ee7f0f3c2578106c8a12acb87223994b5607551e1d0080843377917deffb142ce6946d7ce590bb5
SHA1 hash: f4f69df1451dcd3043a7d345dfb0cf7f90eabf7d
MD5 hash: 9d58bf2f4fc654c146e820900ea5aab5
humanhash: pip-high-lake-december
File name:P.Order _4029530.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'484'800 bytes
First seen:2020-06-09 06:39:28 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ztb20pkaCqT5TBWgNQ7aKbTqJQR25ArBFF8PNId6A:wVg5tQ7aKb/lAPS5
TLSH F865DF2273DF8365CFB252737A15B701AEBF7C2506A5F45B2F98093DAA20121534EB63
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.ovot.in
Sending IP: 103.120.177.239
From: import1@clsteam.pk
Reply-To: accpq1@nestahotel.com.vn
Subject: Official purchase order (PO.4029530)
Attachment: P.Order _4029530.iso (contains "P.Order _4029530.scr")

AgentTesla SMTP exfil server:
mail.logosbd.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 04:52:43 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fd3bn6yfm3rb27525xyzczbbkavwjj6yqzttthnd6ixvhi7sh5zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 28f616fb0566e21d7fbaedf1916421502b64a7d88667399da3f22f53a3f23f73

(this sample)

AgentTesla

Executable exe 21cdc9802a3c3d371a549e3c576e7c13add07a22dbe38cac7b684a0de2f9ab84

  
Dropping
MD5 dab824418133bcaa3099ee9340db7ca3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 21cdc9802a3c3d371a549e3c576e7c13add07a22dbe38cac7b684a0de2f9ab84

Comments