MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 834cb0bd00fa1de7316b720fb546554aeb4e5659275b2c02181958c74f46d7c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 834cb0bd00fa1de7316b720fb546554aeb4e5659275b2c02181958c74f46d7c0
SHA3-384 hash: 4af30ccf885cfd327a766b67a7b78de1ef434b06f2109cd1dc1c62de52ce5e4bb2aa10cfcd941bb5a330060d2ffbf334
SHA1 hash: 3f78f8e4de15536c911ca2e50ba5bb926c6f591d
MD5 hash: 6f171d127bfa4df12d4791c5569ea5fe
humanhash: seven-snake-wisconsin-magnesium
File name:2598_MSC_ NEW_ORDER13_11_2020_LE_,pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:571'392 bytes
First seen:2020-07-10 05:33:46 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:qAoPLKjxd3bHo8TWGPpr2kgQh006jpGByWsJ:BEKjj3bHdvxgQhJByh
TLSH 09C4CF50F3546AEEE42752B58876AC1413337AAB932BC10D289F329E0B7734355B7E87
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corporate.orangemali.net
Sending IP: 197.155.141.42
From: Bill Hwang <secretariat@buroticservices.net.ml>
Subject: New Order
Attachment: 2598_MSC_ NEW_ORDER13_11_2020_LE_,pdf.iso (contains "2598_MSC_ NEW_ORDER13_11_2020_LE_,pdf.exe")

AgentTesla SMTP exfil server:
server03.imanila.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaA.31413.3987.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/834cb0bd00fa1de7316b720fb546554aeb4e5659275b2c02181958c74f46d7c0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 05:35:05 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qnglbpia7io6omlloih3krsvjlvu4vsze5nsyaqydfmmot2g27aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 834cb0bd00fa1de7316b720fb546554aeb4e5659275b2c02181958c74f46d7c0

(this sample)

AgentTesla

Executable exe cd9532fea4c331fed21dd929be9a963c50662e545e38a63fcae56cf13199fead

  
Dropping
MD5 59af638ffef55d24bf6610b29a73e4d4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd9532fea4c331fed21dd929be9a963c50662e545e38a63fcae56cf13199fead

Comments