MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a2137e0c95e3c1537f6061d5ad1ebb769f014fc61f570abd103be838a53758e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a2137e0c95e3c1537f6061d5ad1ebb769f014fc61f570abd103be838a53758e
SHA3-384 hash: b267689f7979dd50739495a186eb38a74ebe595ba2536184b72779e4fa491213135ee02d7e1d481ea8daf62ba130ba5e
SHA1 hash: 544a98903b382763bf55b7159a5e6f8ec39f0442
MD5 hash: 9271d2702ea1fe9d45e3068417746bd9
humanhash: fanta-august-emma-sodium
File name:Invoices SOA.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-25 08:59:28 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:qsO9OarLnD5n29zb05FNMlRjynxAziqqBijwM7Dn6hAJH:qsO9OarblnUo8miSic27m
TLSH AC45F2080258DFA9E67D8779C0F61111C378A217611BF799BE88B4DD3FA3390A48B767
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.emsbd.com
Sending IP: 202.40.181.229
From: Harsh <harsh@adk-media.com>
Reply-To: harsh@adk-media.com
Subject: Payment for Outstanding Invoices (SOA)
Attachment: Invoices SOA.iso (contains "Invoices (SOA).exe")

AgentTesla SMTP exfil server:
mail.haden-tours.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.26029.17820.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a2137e0c95e3c1537f6061d5ad1ebb769f014fc61f570abd103be838a53758e/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=biqtpygjly6bkn7wayovvuplw5u7afh4mh2xbk6rao7ihcstowha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 0a2137e0c95e3c1537f6061d5ad1ebb769f014fc61f570abd103be838a53758e

(this sample)

AgentTesla

Executable exe bfecf1d24ef83e7bc35143c6ef0cc09a0a77902e2fd6ef9f5d5a50d0968c088b

  
Dropping
MD5 99b4f2d418b0e7e222a46c7dff2faae5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfecf1d24ef83e7bc35143c6ef0cc09a0a77902e2fd6ef9f5d5a50d0968c088b

Comments