MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8f2573756b47bd14bdb4db18adb8da6b8925783e11f31910069f27f9a51feed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8f2573756b47bd14bdb4db18adb8da6b8925783e11f31910069f27f9a51feed
SHA3-384 hash: fc7ad95dd8b5da8b01051cdf3505e419f72ab5f1f5df9a006e4c56d1f3affb309ada49b24d7aac9a65706ecd0ce93b57
SHA1 hash: bef14aac831d7753aa4693de6d1dc1e0c1255058
MD5 hash: 64b896e42195ce89366c6ae4f5cd964d
humanhash: illinois-black-nuts-eighteen
File name:Confirm Awb noXXX378920.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:692'224 bytes
First seen:2020-05-22 07:16:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:Ox63e53HHeUsLitdc6AyLWDhQaZWA9V9pQ1+LGV6Gb+4FZtXsB/bxNfO:g63eJne0jaMQ9FGVb+4e
TLSH A7E44A3E7A44A815D13C89332096A98266B5A9473E61C74F3FCD53ACAF037CE3B15369
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: DHL Express <info@orlonvalves.com>
Subject: Delivery Receipt | Confirm Awb no:XXX378920
Attachment: Confirm Awb noXXX378920.iso (contains "Confirm Awb noXXX378920.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.26259.30315.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
13 of 31 (41.94%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso b8f2573756b47bd14bdb4db18adb8da6b8925783e11f31910069f27f9a51feed

(this sample)

AgentTesla

Executable exe 100caf2d2f4f15b4e6df9c8144be104b8e4f24b9f14274fd417951f4c5c23f8e

  
Dropping
MD5 c5575f1a70572fe8a4587220e4cf251b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 100caf2d2f4f15b4e6df9c8144be104b8e4f24b9f14274fd417951f4c5c23f8e

Comments