MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5672af2e192acbd1daa7647e24c6998ecf5f32d8e0523c0bb1cf461a2d2a557b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5672af2e192acbd1daa7647e24c6998ecf5f32d8e0523c0bb1cf461a2d2a557b
SHA3-384 hash: e2bd7708d8fcbc0d703a7563e073b570225d973ef044b0fe86f716ca6ed57b1d0dd34f64ccf8fb95d7fca8bffc43e89f
SHA1 hash: 91a4fcacf1d69a24b709825fa2ebf19b1ff37fc8
MD5 hash: fc55cbacc2df64ae4d31770959ffeac7
humanhash: mirror-montana-zulu-asparagus
File name:Message Body.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:776'192 bytes
First seen:2020-07-02 07:48:55 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:DP5w7ocik7q7RJIQUzIO6gBNwTeWY0OOEXnE2qEA:b5mocbq1sz7TwT8lX7XA
TLSH CFF4D00133ACA579EE3D0BB2AA2B48500BA3387DD130965E36DDA11F6FE3B168517753
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: İHSAN NECİPOĞLU <enquiry@oxy99.in>
Reply-To: İHSAN NECİPOĞLU <enquiry@oxy99.in>
Subject: Enquiry
Attachment: Message Body.iso (contains "Message Body.exe")

AgentTesla SMTP exfil server:
mail.northwestpowdercoating.co.uk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WQV.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5672af2e192acbd1daa7647e24c6998ecf5f32d8e0523c0bb1cf461a2d2a557b/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:50:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kzzk6lqzflf5dwvhmr7cjruzr3hv6mwy4bjdyc5rz5dbuljkkv5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 5672af2e192acbd1daa7647e24c6998ecf5f32d8e0523c0bb1cf461a2d2a557b

(this sample)

AgentTesla

Executable exe 0dbbf2cbc107003ef3ed572699f04d0de6c00c65a6aece3098f7a473acd0f834

  
Dropping
MD5 1f9200eeac6c61af180dd134d31ebe7a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0dbbf2cbc107003ef3ed572699f04d0de6c00c65a6aece3098f7a473acd0f834

Comments