MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de
SHA3-384 hash: 26f291433ddf1eb6c89370baa904284ed572be5ac48f54ff3bd8f6d8d057744c5f3e94a1f1a2b00bd7cff24e2b7d6b82
SHA1 hash: 964286cd527ada6ad898f1c50e1d34a2ca09c03b
MD5 hash: 739e7204a241ea6c21299703f3ce8e6d
humanhash: apart-tango-winner-mobile
File name:Payment 01.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-21 07:44:44 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:Bd9J0nsg+SyRw6TBxpOyHg4q4Peyxhv7VvWRXnQ5SSjkwlObexBw:WaEX4ZPeyNvWuvrlOK
TLSH 46453800E7B446C9D7AA56B8D460400082E0A936B7F6EF596B44F1E939EF7909F1FF12
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ubuntu.boostinghe.com
Sending IP: 91.92.136.76
From: Account payable <accs@skatool.com>
Subject: Payment Transfer
Attachment: Payment 01.iso (contains "Swift.exe")

AgentTesla SMTP exfil server:
mail.targethyd.com:26

AgentTesla SMTP exfil email address:
thampan@sunbeampower.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:46:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cocj6vq672wrlk3tn5jvc2jyhxcomllcb5bziq3qonmmdy7iydpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 13849f561efead15ab736f535169383dc4e62d620f439443707358c1e3e8c0de

(this sample)

AgentTesla

Executable exe 79459d933d490e7b12cea45b59a86fed6c9f6271feab12fdbfa25fbc791adf4e

  
Dropping
MD5 927becc05e9cf116ab2f3359c33bcacb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79459d933d490e7b12cea45b59a86fed6c9f6271feab12fdbfa25fbc791adf4e

Comments