MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e28c0cd5518a51e09971d147d8269b80319e2293768bcad79fc476add474dca0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e28c0cd5518a51e09971d147d8269b80319e2293768bcad79fc476add474dca0
SHA3-384 hash: 63ed48c1dae9088162693e2994b2081387e0a538c2296d90d0cd4d1f2af8c913d79764ada95b052948f4f7e52d300b5b
SHA1 hash: 6a33c4ca42d44ba5a20440e2d098681c118c7c69
MD5 hash: 44162e89aa6f083effa5fdf37ef5f9ca
humanhash: texas-nine-zebra-helium
File name:PO-7546354.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'703'936 bytes
First seen:2020-07-09 06:30:53 UTC
Last seen:2020-07-09 06:31:14 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:Graw2YLTESRzsMbMXakdr5dGTxSU+V/l0FG5:wawFLwSlsTDdrvGTxSU0/l
TLSH D275023133A88F14C7B98F3298B820415F71BA176923F39FBDC9259D0B9B7590512B9B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.24january.ro
Sending IP: 5.2.182.144
From: Taylor Clarke <t.clarke@chemeon.com>
Subject: CHEMEON-OUR REF: PO-7546354
Attachment: PO-7546354.ISO (contains "PO-75463545.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.941326.26659.22315.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Generik.LTEZXNA.24739.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e28c0cd5518a51e09971d147d8269b80319e2293768bcad79fc476add474dca0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 06:32:07 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4kgazvkrrji6bglr2fd5qju3qayz4iuto2f4vv47yr3k3vdu3sqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso e28c0cd5518a51e09971d147d8269b80319e2293768bcad79fc476add474dca0

(this sample)

AgentTesla

Executable exe a88128dd100fe7852a7ddf40b9ba6725c66cb3073c017f6c74245bc493b88eb9

  
Dropping
MD5 3e03e5761d8383e715dbd6448806b72a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a88128dd100fe7852a7ddf40b9ba6725c66cb3073c017f6c74245bc493b88eb9
  
Dropping
SHA256 9105fddbf7ca864fe5d867a903e7c80bafecc9d3530ec791fdaf93366067b252
  
Dropping
MD5 45394c0479e6c67b50f6d43440edbbc6

Comments