MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a536d9bbaf7ea3e88dd0878f96f9c6b11322655af0820bbf1097d76474a09c06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a536d9bbaf7ea3e88dd0878f96f9c6b11322655af0820bbf1097d76474a09c06
SHA3-384 hash: 41ec40a144127f3567f51c791359c3fe6173ccb9be53185c35217bf69f701e7d7deea060e80475294d6d3efe3be07e62
SHA1 hash: 9d1cb37dccbb67a2c72ac5e673e204fc47d3db81
MD5 hash: 261ceecf895766ecf425c0f6e8242dc7
humanhash: johnny-fourteen-six-lion
File name:INVOICE999901.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-09 11:58:26 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:m/MOE9s6Fm4iWmXq5+0lZ7LThCnUacTaulCSRO6:ygvTmXy+EZ7LInULTESR
TLSH FE4512F9B3AC0F22E97007F9197561804FF4740B11A6E66E7DCD20CA2B65F809A50F6B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.strusasu.com
Sending IP: 45.95.169.147
From: admin@sportsboules.org.sg
Subject: PROFORMA INVOICE
Attachment: INVOICE999901.ISO (contains "INVOICE999990.exe")

AgentTesla FTP exfil server:
asnbanknl.com:21

AgentTesla FTP exfil user name:
smartpips

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34143469.31331.13663.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a536d9bbaf7ea3e88dd0878f96f9c6b11322655af0820bbf1097d76474a09c06/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 05:28:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uu3nto5pp2r6rdoqq6hzn6ogwejsezk26cbaxpyqs7lwi5fatqda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso a536d9bbaf7ea3e88dd0878f96f9c6b11322655af0820bbf1097d76474a09c06

(this sample)

AgentTesla

Executable exe 88ac38fd4d4a5bff6e2f09c5071b6b8d654e2d65da6662c02d14fabb32047ca7

  
Dropping
MD5 005f4b79b9e9fdb2690c8e2db96daa7d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 88ac38fd4d4a5bff6e2f09c5071b6b8d654e2d65da6662c02d14fabb32047ca7

Comments