MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f011c9ebaba294269f9658d916b56d6675b1e1f96e212d57246b81fe438650d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f011c9ebaba294269f9658d916b56d6675b1e1f96e212d57246b81fe438650d
SHA3-384 hash: 64429be4a1f0ce2aef6f4e44c3f9270f2e0c1a4dbf03340ec1b01329551ea4732d9c5508252dc1c9c7abd2212cb057a3
SHA1 hash: 12b30005840a512d7c373bc591afc5a304e6c6fb
MD5 hash: 60da2fc04d9fd115acd38c7bc52e298b
humanhash: quiet-alanine-missouri-coffee
File name:PO19000450.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:573'440 bytes
First seen:2020-06-10 07:35:42 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:zRgIlSbJZTJacPov/9/Pzbf2lGHaEh7YYv1d7N10qFUlTMFQOvH:27tZTJaIov/9/bbf2l1YvrT
TLSH D8C4AE883650B29FC46BCC7289E92C64AB6175A7532BD343744B12ED9B0E7D6CF012E7
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s6.paukhost.com
Sending IP: 88.99.110.27
From: Clara.Luo <clara.luo@eolane.cn>
Subject: 全新PO 19000450 INDG-17133257
Attachment: PO19000450.iso (contains "PO19000450.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:37:15 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4arzhv2xiuue2pzmwgzc22w2ztvwhq7s3rbfvlsi24b7zbymugq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 5f011c9ebaba294269f9658d916b56d6675b1e1f96e212d57246b81fe438650d

(this sample)

AgentTesla

Executable exe b265a179bab6fe80bb3b81544e3f04e285a7b90b17e01bc34881e502aa5bb489

  
Dropping
MD5 a616113e6c22ba0632f0cf602e715373
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b265a179bab6fe80bb3b81544e3f04e285a7b90b17e01bc34881e502aa5bb489

Comments