MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89b19c0b32a33dfc7f35a7e819e888e8fe115c4754e0bf0dadd1c634cd116ca2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89b19c0b32a33dfc7f35a7e819e888e8fe115c4754e0bf0dadd1c634cd116ca2
SHA3-384 hash: 1e2664ecd24e38e281ee17051d9842267b8857d71852c6bb90beaf107722a9313b28465ed22c081339606ad9ecfe7a35
SHA1 hash: 4960b51dcc9d4cdb7d111022b2676480c07d9cd7
MD5 hash: 52fb36b5a45c1246ce2f8b899aee77b4
humanhash: zulu-mountain-west-nineteen
File name:quotation.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'240 bytes
First seen:2020-04-20 14:17:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:lTLNdI32rqPFov3O+IDqAgjwKpuUFhvZ7IjDuA3ErWy6Idjw:9NdI8qv+Ie7vujiUA79jw
TLSH 05B40244B55CAA2BCBBE08BB4096650093F7852DE8A5E3E03EDDA0E997DFFD46004357
Reporter abuse_ch
Tags:AgentTesla COVID-19 iso


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: vip.163.com
Sending IP: 95.211.209.158
From: sale <tungtay@vip.163.com>
Subject: RE:COVID-19 IgM - IgG Test Quotation
Attachment: quotation.iso

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587 (208.91.199.224)

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200420-0804.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-20 09:20:26 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rgyzyczsum67y7zvu7ubt2ei5d7bcxchktql6dnn2hddjtirnsra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 89b19c0b32a33dfc7f35a7e819e888e8fe115c4754e0bf0dadd1c634cd116ca2

(this sample)

AgentTesla

Executable exe d054fd7ff375bd7390235a1a8e48e162c3211d4e2f27040de4bc6ba1f0b0746b

  
Dropping
MD5 46c0c3544d3d1a6619c06ae78895dbe0
  
Dropping
SHA256 d054fd7ff375bd7390235a1a8e48e162c3211d4e2f27040de4bc6ba1f0b0746b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d054fd7ff375bd7390235a1a8e48e162c3211d4e2f27040de4bc6ba1f0b0746b

Comments