MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b686df78eb53190a4e0c477c2e6b11971ccdc9b1fd03ae68c89242156b37c3a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b686df78eb53190a4e0c477c2e6b11971ccdc9b1fd03ae68c89242156b37c3a7
SHA3-384 hash: 997e82e53bb44a5b4b0372987fbe012d4a120efa9a7871e08568eb2c8282a3458b1d800c5cb63c06708f97db22dabdcb
SHA1 hash: 9b8bd7da7ee3d124cfba8fd61f6203492babe334
MD5 hash: 4e34cfc4295284fd692d5417030f8026
humanhash: eighteen-robert-monkey-double
File name:quotation.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'656 bytes
First seen:2020-07-02 09:23:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:vehU2N11MmD+Zjspzkcyi1krJHpLxvkJmRapOJWkn5MO1Q+jZ3Hqx7oG:u5zufj5cy0oLsJmkOJzz1F3HD
TLSH 2CA4F02427FC5228FEBA2B74AAB650459333B9A82431D76E394C701F1FBBB419611773
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eagle266.startdedicated.com
Sending IP: 69.64.39.14
From: Mohammad Abdul Raouf <smj@dasanzhone.com>
Reply-To: smj@dasanzhone.com
Subject: REQUEST FOR QUOTATION
Attachment: quotation.iso (contains "5pYqVSLb008hMz3.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WQV.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b686df78eb53190a4e0c477c2e6b11971ccdc9b1fd03ae68c89242156b37c3a7/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 09:25:06 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w2dn66hlkmmqutqmi56c42yrs4om3snr7ub242gisjbbk2zxyotq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso b686df78eb53190a4e0c477c2e6b11971ccdc9b1fd03ae68c89242156b37c3a7

(this sample)

AgentTesla

Executable exe 17ed2f2ec07ba4a175b698cd30b172ca2e8fe8ebb2a13e08e6e1f3990781888a

  
Dropping
MD5 80172a1f2aae05cfaed9f3c43d64242c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 17ed2f2ec07ba4a175b698cd30b172ca2e8fe8ebb2a13e08e6e1f3990781888a

Comments