MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a61087385d17cb63448fcf9658bbbca52bb4679301f2e505993e6a74087b5b39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a61087385d17cb63448fcf9658bbbca52bb4679301f2e505993e6a74087b5b39
SHA3-384 hash: 2df95a8a2af3c47943314c08f6de9b641feaf769384fb65779a122cc9e7d5bb882516714c878696329d2f50a0835290d
SHA1 hash: 72b32edf3653a9fc412c037547fcd26177cb79b6
MD5 hash: fbce8c0a51b32b1b1c4f32a1f3eea822
humanhash: venus-item-leopard-oscar
File name:New Order Inquiry 072820.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:550'912 bytes
First seen:2020-08-31 13:17:47 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:aL65CbOeFslIVIgj2Lc191Ygp6d7jeIR75dcBnDiDC60hp7o6T+oNZqF4:T5CbhFC+aw192tjeo7
TLSH 66C41255262C8772DAF60BF5545E7828D376981B607ED3CEB8ED228A03E33984723717
Reporter abuse_ch
Tags:iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.confidencegroup.co
Sending IP: 162.144.59.93
From: Hunan Standard Steel Co <info@ocepasinov.com>
Subject: New Order Inquiry 072820
Attachment: New Order Inquiry 072820.iso (contains "New Order Inquiry 072820.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a61087385d17cb63448fcf9658bbbca52bb4679301f2e505993e6a74087b5b39/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 04:15:03 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uyiiooc5c7fwgrepz6lfro54uuv3iz4tahzokbmzhzvhicd3lm4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a61087385d17cb63448fcf9658bbbca52bb4679301f2e505993e6a74087b5b39

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso a61087385d17cb63448fcf9658bbbca52bb4679301f2e505993e6a74087b5b39

(this sample)

AgentTesla

Executable exe c4d5fab1e5e40cf0377d5eaca0e427d01fcd61495743ea4290d8745163e84e56

  
Dropping
MD5 e2f4002aff46a73990dbdc38109df9b7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c4d5fab1e5e40cf0377d5eaca0e427d01fcd61495743ea4290d8745163e84e56

Comments