MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b8d0bf23faebc16ef5f3c8f9b82472586209ee0fbff82cc81af77024192d28e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b8d0bf23faebc16ef5f3c8f9b82472586209ee0fbff82cc81af77024192d28e
SHA3-384 hash: ea0857cde59e523a97f555f133dd0407c2f142d4dd327007b60c7389fa28437dbe807bf596a9aeb193f2cd580e4fca08
SHA1 hash: 54b44e9a83349e21cb8af195c953324a9629ec64
MD5 hash: e4ed957fe3f5496455635966e8987863
humanhash: don-leopard-montana-steak
File name:Shipping Documents FINAL WARNING.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:780'288 bytes
First seen:2020-07-29 06:25:36 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:dkzwuh8BSfN7Bv16pDBCNUg5v2nZuvBdHI6WTJ1JK6ipY9ID382FI1JtpkmOdd0/:dYwutfN7BvQ02iITJu6tGs+ODpkG
TLSH 60F44B3D7A816505C43C2676C1F56AC276F2B58B2E12C30E78DA175CAF027DB3B4636A
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.soctrade.ga
Sending IP: 192.241.247.202
From: DHL | Express Shipping <sales@soctrade.ga>
Subject: Urgent: Shipping Documents (FINAL WARNING)
Attachment: Shipping Documents FINAL WARNING.iso (contains "Shipping Documents (FINAL WARNING).exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b8d0bf23faebc16ef5f3c8f9b82472586209ee0fbff82cc81af77024192d28e/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 02:40:00 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pogqx4r7v26bn327hshzxashewdcbhxa7p7yftebv53qeqms2kha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 7b8d0bf23faebc16ef5f3c8f9b82472586209ee0fbff82cc81af77024192d28e

(this sample)

AgentTesla

Executable exe 78ba6f6da444f33682e0878941f2258ea538b85eb1b7b96d7d15e19656327664

  
Dropping
MD5 b536f38b18b4d21973e8d2c19620da37
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 78ba6f6da444f33682e0878941f2258ea538b85eb1b7b96d7d15e19656327664

Comments