MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 331150d802dcf2e28f83e07c39959c0f56d12eeeeac67184073ceb3cdf578bbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 331150d802dcf2e28f83e07c39959c0f56d12eeeeac67184073ceb3cdf578bbb
SHA3-384 hash: 5ae7d329a621524673e870a31052389ab50ef11c2932bf79c4621554945ed8f3cf8e9d07af6148dbad9db8584d2cfba1
SHA1 hash: 0dbf04dfaa7066ba9a13f574e0764e2adbdc55ba
MD5 hash: d0da375e516acd8051e4e7dfcbf686f5
humanhash: indigo-pip-north-glucose
File name:BANK OF AMERICA_PDF_____________________________________,,,,,,.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:708'608 bytes
First seen:2020-07-29 07:52:29 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:k9XEI3ZAaddOM2TsqJlfIw1nxfsp4a9jjWFwuKohPLurd:kBrONww1xfO4a9fWiuKILurd
TLSH C6E414022144471FDB1B94B57127C0F02297C8AAEB65EA776E8FF1930AE22FD3493657
Reporter abuse_ch
Tags:AgentTesla BOF iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.mail.hitutorhr.com
Sending IP: 210.242.229.119
From: Shama Francis <bunnyedb1@hitutoracdm.com>
Subject: BANK OF AMERICA Beneficiary Payments Advice
Attachment: BANK OF AMERICA_PDF_____________________________________,,,,,,.iso (contains "BANK OF AMERICA_PDF_____________________________________,,,,,,.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/331150d802dcf2e28f83e07c39959c0f56d12eeeeac67184073ceb3cdf578bbb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 07:54:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmivbwac3tzofd4d4b6dtfm4b5lnclxo5ldhdbahhtvtzx2xro5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 331150d802dcf2e28f83e07c39959c0f56d12eeeeac67184073ceb3cdf578bbb

(this sample)

AgentTesla

Executable exe e7198a6f6cf52e2f218e8354fbe9d3a59f7154aec99ec74d51017f7f9ff82ba1

  
Dropping
MD5 7a76f50c99d202d18012047f6c3732f7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7198a6f6cf52e2f218e8354fbe9d3a59f7154aec99ec74d51017f7f9ff82ba1

Comments