MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ab8a85e7b6a367ee41982539225b40728a592b54b50528ec6a3132e68ecc7f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ab8a85e7b6a367ee41982539225b40728a592b54b50528ec6a3132e68ecc7f8
SHA3-384 hash: 303894d48088f8ec411ad44280ac4f0a0aa38deb5287a6ca05ce886a65d9f176d0596fdb5ee0c9cad6ca31d4cdbfe1b2
SHA1 hash: a626514520549c3d53f2c8b3dc284070dac3a283
MD5 hash: 54f6deb2fc8a93248f34f1e1393ff038
humanhash: high-cola-july-twenty
File name:New order 00 73667,pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'036'288 bytes
First seen:2020-08-30 08:52:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:7u3qDqljanetnCyBQExy+m0WyUF5gmjm8OWbijyLAbNLV5K4GdtH99S7Jh81XBKC:KaMnCyqEc+8ysgXXVwAB+mlhzG0q
TLSH 5625BF1223099F6CE429B379A470901CD3F3AA43D735D5CDFD9F61EC0953B8A916AA83
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corporate.orangemali.net
Sending IP: 197.155.141.129
From: Marco Meneghetti <sales@caretek.com>
Subject: New Order
Attachment: New order 00 73667,pdf.iso (contains "New order 00 73667,pdf.exe")

AgentTesla SMTP exfil server:
smtp.1and1.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43748944.30973.16034.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ab8a85e7b6a367ee41982539225b40728a592b54b50528ec6a3132e68ecc7f8/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 01:49:35 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jk4kqxt3ni3h5zazqjjzejnua4uklevvjniffdwgumjs42hmy74a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4ab8a85e7b6a367ee41982539225b40728a592b54b50528ec6a3132e68ecc7f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 4ab8a85e7b6a367ee41982539225b40728a592b54b50528ec6a3132e68ecc7f8

(this sample)

AgentTesla

Executable exe d735d78db9d0d7b0826237f6500bb5190f23e6fc01218ae6ce75993bcd634b07

  
Dropping
MD5 fd4370ca5d25f6bd058370133409d7a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d735d78db9d0d7b0826237f6500bb5190f23e6fc01218ae6ce75993bcd634b07

Comments