MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a342edf2ac6f52746e1460ae04c69580eb01736b24f24cc76f323a52d4b4062c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a342edf2ac6f52746e1460ae04c69580eb01736b24f24cc76f323a52d4b4062c
SHA3-384 hash: 5cfd4a8f64e3b6da5b64c1226bef2bcc00d3d22e01dc96d55910571cdfee2990ddc851865bdc29458d1e81cc7ef984c0
SHA1 hash: bcb33723aedea347d49747b24dfa17a0c86945d9
MD5 hash: a42d5729c44a8d8818ccf69817238531
humanhash: bulldog-india-pip-magazine
File name:REQUEST FOR QUOTATION.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:763'904 bytes
First seen:2020-08-11 10:56:06 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:uHwSFbVgrpiAFC63iTYpV+8Awl4WzKGTBtkYYW2Cm1I8dZHMOcHgmgGt/3jh9sIM:uQLQAJiTYpIwu+tkYBHme2Z
TLSH AEF48DAC325876DEC4978D36896C2C50AA217D275B1FC60BA01B31AD5E3DB97CF106B3
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eagle266.startdedicated.com
Sending IP: 69.64.39.14
From: Mohamed Al-Kharjy <test@surgiwear.co.in>
Subject: Re : REQUEST FOR QUOTATION
Attachment: REQUEST FOR QUOTATION.iso (contains "REQUEST FOR QUOTATION.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.1099.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a342edf2ac6f52746e1460ae04c69580eb01736b24f24cc76f323a52d4b4062c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 10:58:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=unbo34vmn5jhi3qumcxajruvqdvqc43letzezr3pgi5ffvfuaywa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a342edf2ac6f52746e1460ae04c69580eb01736b24f24cc76f323a52d4b4062c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso a342edf2ac6f52746e1460ae04c69580eb01736b24f24cc76f323a52d4b4062c

(this sample)

AgentTesla

Executable exe 968fda7e4a26ba09c4f69157d988a9cf4929894f126219ac811c3986a810508b

  
Dropping
MD5 171bb13a9686dedb3072c8f595298efb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 968fda7e4a26ba09c4f69157d988a9cf4929894f126219ac811c3986a810508b

Comments