MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff7e033603de3dd8bef29dbc4a7a903491caae9a0cbe7aea4cb95bd0e5ab771f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff7e033603de3dd8bef29dbc4a7a903491caae9a0cbe7aea4cb95bd0e5ab771f
SHA3-384 hash: ab64de39de9e39c42f9a92a60afbc0e3313223a310112c0051bfa591a18ccf42790f1a2ff34996916e6429ae732af2cf
SHA1 hash: 2d14ea713fe5d2c7adc7e78992368a31a82e8957
MD5 hash: cbbe8cd0f5253d5082f66ced5102f40e
humanhash: mirror-wolfram-fourteen-hamper
File name:Parcel N0.EMS9480029129.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2020-08-15 07:44:19 UTC
Last seen:2020-08-15 08:30:37 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:BX9fHbOivhRZTa//lJLDYWr2WjmgPD/GijHn1v8HAtyJNz4dskp:BNTk1JDx2wKIl3ty0Gk
TLSH 2655F1136A4887ABE01F6FBD12B12521A7F0A317F346EE9C7E8E01E9DF825C653C1645
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: backup.indocyber.net.id
Sending IP: 103.31.134.131
From: EMS Express <csu@emsng.com>
Subject: EMS Shipment Arrival//Parcel N0.#EMS9480029129
Attachment: Parcel N0.EMS9480029129.iso (contains "Parcel N0.#EMS9480029121.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.4e498eb4dc11e62e.21039.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff7e033603de3dd8bef29dbc4a7a903491caae9a0cbe7aea4cb95bd0e5ab771f/
Threat name:
ByteCode-MSIL.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 07:19:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=757agnqd3y65rpxstw6eu6uqgsi4vlu2bs7hv2smxfn5bznlo4pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff7e033603de3dd8bef29dbc4a7a903491caae9a0cbe7aea4cb95bd0e5ab771f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso ff7e033603de3dd8bef29dbc4a7a903491caae9a0cbe7aea4cb95bd0e5ab771f

(this sample)

AgentTesla

Executable exe 3b74c2f8330e4a13915efff621b1eaba4ba50becaa826071fc9e96edd0079f69

  
Dropping
MD5 4e498eb4dc11e62ee048e2c945c4ce0f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b74c2f8330e4a13915efff621b1eaba4ba50becaa826071fc9e96edd0079f69

Comments