MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c
SHA3-384 hash: 982af67016591371536a5688a6d6e46cc6dd35c24449b2c36f3bd7f6c2e2ae21b5bc4cb6e400212c0b18b5276d6c1a2d
SHA1 hash: 8d7d1a4893fa14d8bdaccfb1496cffc536fa3c8e
MD5 hash: 857826f55ba2fc789751524550737296
humanhash: iowa-glucose-asparagus-william
File name:Original_Document.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-20 17:20:32 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Ikh8KirVcrI73IaXMI4YBIlvuCC3NRi1U+ygwUVXSGlPN:Wpn73IacI0huHNUGgwU4QN
TLSH 534512BD82996A1BD13C49B84102228567F6E0137027F74AFDDC60F96BCA3D5DB424EB
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email
From: "DHL Global Forwarding." <dhlsender@dhl.com>
Received: from mail.sap-express.com (mail.sap-express.com [103.31.132.106])
Date: Thu, 20 Aug 2020 17:31:09 +0100
Subject: DHL Shipment Clearance Notification 2283223014
Attachment: Original_Document.iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 17:04:10 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
14 of 27 (51.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzvkcf6jxua2sxgsgsb5x5r7p7sx65cki6pam4fu3bdykmkbe4ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c

(this sample)

AgentTesla

Executable exe 7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c
  
Dropping
AgentTesla

Comments