MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94c0c2f6dcad5e178ca4ac59a40b48764be691bb53684c76072bab198742838e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94c0c2f6dcad5e178ca4ac59a40b48764be691bb53684c76072bab198742838e
SHA3-384 hash: 1f1a5696f7131907fac0237c4856412b87e04807d8e18921917ce3ec129c4e4b4167b58b7d9b161d92fc818a35570cc1
SHA1 hash: 4f23d05499625c741d2fbc471758abbc0333c099
MD5 hash: c136d4a81feb5a84c01ba36ee9bcab5c
humanhash: hamper-four-massachusetts-green
File name:Attached New Order.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:643'072 bytes
First seen:2020-07-07 09:31:58 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:M4Z+HAnlsp1obMi8lWL/3f7EE4BPu00gckl2+OHihfGPY0Ek4uFquAesakNv2U+A:MZkU+xBvYv3dKQ5Hafrmra8
TLSH 22D4BE713221DE63C63E08F7900118401FB5A457F6ADE3D9BDCA69DE03C6BD09A626B7
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: manage.hosteering.com
Sending IP: 172.104.59.85
From: AKHILA NAND MISHRA <info@betechlk.com>
Subject: Re:Re: Attached new order
Attachment: Attached New Order.iso (contains "Attached New Order.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94c0c2f6dcad5e178ca4ac59a40b48764be691bb53684c76072bab198742838e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:33:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=stamf5w4vvpbpdfevrm2ic2iozf6nen3knuey5qhfovrtb2cqoha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 94c0c2f6dcad5e178ca4ac59a40b48764be691bb53684c76072bab198742838e

(this sample)

AgentTesla

Executable exe f30ee3780bafae722faf43979da52a7657e0afa59f5621f50df938cb7a61316f

  
Dropping
MD5 53c74b55107cc7a08260559c256a4ca6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f30ee3780bafae722faf43979da52a7657e0afa59f5621f50df938cb7a61316f

Comments