MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 142d7d12586e69ac6acb9f4c8f5cb58865d4cdc8e145d3004a187b86e59795fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 142d7d12586e69ac6acb9f4c8f5cb58865d4cdc8e145d3004a187b86e59795fe
SHA3-384 hash: 1057591601bbaa6fef808ba1d8117c58649069d6057bf6947bebeead5dfefd908a3d4ce9e7930be192549414ac32ca08
SHA1 hash: 0c391eccdeeb38139575aec36dacdcbe918706d6
MD5 hash: 23e60b66b8e60b6bbad267b2cc3207bc
humanhash: orange-nineteen-seventeen-queen
File name:INVOICE.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:761'856 bytes
First seen:2020-12-16 09:39:34 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:swn78ySO5124TOsDLC7xQ2/CcM0CZQOnYpetKaIKOXDWB7dHUdj8/o20+7yCWslq:/ZWGFmdjEcR
TLSH E4F47D243AFF6018F173AF764AD474D6DAAFFA733706D42E1494038A0723A85DD9163A
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Accounts Payable NZ <vn.sgn.payment@one-line.com>" (likely spoofed)
Received: "from postfix-inbound-5.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "16 Dec 2020 01:30:32 -0800"
Subject: "URGENT: Invoice overdue for Nov,28 (last month)"
Attachment: "INVOICE.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/142d7d12586e69ac6acb9f4c8f5cb58865d4cdc8e145d3004a187b86e59795fe/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-16 09:40:07 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cqwx2esynzu2y2wlt5gi6xfvrbs5jtoi4fc5gackdb5ynzmxsx7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/142d7d12586e69ac6acb9f4c8f5cb58865d4cdc8e145d3004a187b86e59795fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 142d7d12586e69ac6acb9f4c8f5cb58865d4cdc8e145d3004a187b86e59795fe

(this sample)

AgentTesla

Executable exe 790b9501040e50e166ca0a8f6977348a39bcd1953b9aa708008cd8b6fc9a3b3e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 790b9501040e50e166ca0a8f6977348a39bcd1953b9aa708008cd8b6fc9a3b3e
  
Dropping
AgentTesla

Comments