MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a0b4673b76e22c6deb6a9999ca21099d07f3935adabf856b00ddd091fe95196. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a0b4673b76e22c6deb6a9999ca21099d07f3935adabf856b00ddd091fe95196
SHA3-384 hash: d6ed407545bd4393a6b7441d095bca4db64f749c3035efc3d3119ed6f93644f930d20364a41a96363258a4bf08d640ac
SHA1 hash: 2f2cacde57ce99b875cb30088abd80051abd2f55
MD5 hash: add4a14c244a22dc0d75df3479e34457
humanhash: happy-violet-asparagus-hamper
File name:MT103_COPY.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-05-26 08:00:04 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:GI7Yzc9/94Il7xQ+DR9Y+UHj08C8JfjRmtD+9jJeCXLf+L4d7hUu:azc9H7xRDR9cHj08guhU
TLSH 9755D0143B995C47C67A06B846F1E36403798DF5BD48C30BAC523AED5E73BCA6D028B6
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ccco-joo.com
Sending IP: 103.141.136.136
From: Hussein.<hussein.m@ccco-joo.com>
Reply-To: hussein.m@ccco-joo.com
Subject: TT_Copy #789021
Attachment: MT103_COPY.ISO (contains "LnQ7TU3HwPC6LSe.exe")

AgentTesla SMTP exfil server:
mail.sridurgaagros.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:36:53 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 5a0b4673b76e22c6deb6a9999ca21099d07f3935adabf856b00ddd091fe95196

(this sample)

AgentTesla

Executable exe 27a7cd9a2380c6105c5816806f58b4a4a8466c716f64fedb72638821e9ad3968

  
Dropping
MD5 0c19e2c7b0110f2e5a2e64b8524670f5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27a7cd9a2380c6105c5816806f58b4a4a8466c716f64fedb72638821e9ad3968

Comments