MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0b8eb47cd255cc91a6c86c7b91d76d99fb1085ebe19fe34180ecfcf0c7149e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0b8eb47cd255cc91a6c86c7b91d76d99fb1085ebe19fe34180ecfcf0c7149e9
SHA3-384 hash: 536b6563410103f157d917a2fc6c67a481112e91cb1031e0d88b4e91ea875a0528f0c69ed1a290b9c480397b3068e38a
SHA1 hash: ac37eca4f900e2650af90037a93e01345c29a78d
MD5 hash: 3e3223003228509173a77e9391e68e3c
humanhash: michigan-eighteen-beryllium-snake
File name:Download_Tracking_Reference.11.06.2020.xlsx.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:485'376 bytes
First seen:2020-06-11 07:01:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:khavqc/IhTqKFRwsbaI9z9fcxOxDhv+7uPY4Np1e9bcWVJzNLiQIb:fiF+Kfz9UxsV64NpOcWP9ir
TLSH D3A4125039E8D696D9BB47B99461101043B6B836B5F3FB0E3EDCB1EA5B2B3114650B33
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host17.axxesslocal.co.za
Sending IP: 154.0.162.179
From: DHL EXPRESS <dhlSender@dhl.com>
Subject: DHL EXPRESS SERVICE ***YOU HAVE A PACKAGE READY FOR PICKUP***
Attachment: Download_Tracking_Reference.11.06.2020.xlsx.iso (contains "Download_Tracking_Reference.11.06.2020.xlsx.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.42048.72.30595.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 07:03:06 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4c4owr6nevomsgtmq3d3shlw3gp3ccc6xym74nayb3h46ddrjhuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso e0b8eb47cd255cc91a6c86c7b91d76d99fb1085ebe19fe34180ecfcf0c7149e9

(this sample)

AgentTesla

Executable exe aab6d3a004dab00fc73f89b005b7d0e01314473dcfe6ff4acb6fe84c9b139cfb

  
Dropping
MD5 347afc1a6294fb2afebc6dfe4b7a7234
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aab6d3a004dab00fc73f89b005b7d0e01314473dcfe6ff4acb6fe84c9b139cfb

Comments