MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b431e75b372a4a3b239b22f739eaaf3771fbfdd9e97dfe1e5e48a53f83ae0d5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b431e75b372a4a3b239b22f739eaaf3771fbfdd9e97dfe1e5e48a53f83ae0d5e
SHA3-384 hash: 89c989e71a10208addf84fd67f99e2cf88b040b6cedb4dff95d1d94e21c102d68fc3c6ce4afbd89ed0a3c085448b8b18
SHA1 hash: cab786f7ed83101a77c9d79503372474bacf0c8a
MD5 hash: e8228540c2557849fde0acd5a7afc3ad
humanhash: golf-chicken-ten-west
File name:ESSAR Phase II Well site facilities project.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:509'952 bytes
First seen:2020-05-12 15:55:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:lwKOOL8s1rCD1UCOc7V+fVAWgAk7A/bPzeLv:O0wstE1Kc7VrNADPy
TLSH 65B4F1257298BE03CE4F51FE949051C083BAA15D50E6F3AA3CEE65EA13C5BD20591F8F
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.arrabona.hu
Sending IP: 212.108.197.187
From: HAMEED ERIC <hameed-eric@essar.com>
Reply-To: md@essar.com
Subject: Re: Urgent RFQ for supply of Piping&Fittings/Materials & Equipments for Essar Phase II Well site facilities project.
Attachment: ESSAR Phase II Well site facilities project.iso (contains "ESSAR Phase II Well site facilities project.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 06:02:00 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqy6owzxfjfdwi43el3tt2vpg5y7x7oz5f674hs6jcst7a5obvpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso b431e75b372a4a3b239b22f739eaaf3771fbfdd9e97dfe1e5e48a53f83ae0d5e

(this sample)

AgentTesla

Executable exe 059902f52c04ca2ebba4a9d7c50acd5da1306b1e228ffa57ae5aba61f25a6c59

  
Dropping
MD5 e98824d3d13e4045ba180893a9b8f7a1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 059902f52c04ca2ebba4a9d7c50acd5da1306b1e228ffa57ae5aba61f25a6c59

Comments