MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18504de92dfe22752a703f195d964dc32c99b834168db96a0ad1ec0107a9698b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18504de92dfe22752a703f195d964dc32c99b834168db96a0ad1ec0107a9698b
SHA3-384 hash: 141793defd17c896a4a7ecc8b4888a04376fbff7332de40a7c32fe54c78c439a286d2079eeb7d48bacb9a464d2529e96
SHA1 hash: 01fdfed850c5473e8d4dc0561ba54c0387a4b853
MD5 hash: 8f3d2f6668b34ba653c5da4a84cd1269
humanhash: item-echo-kilo-lion
File name:doc_202005127687980,XLS.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:755'712 bytes
First seen:2020-05-12 09:19:38 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:JKHTWmKQHJ7WK39zqqEPTjr49NNE/Oao1FZujplCV3Li09zDT:JgWw99+NPE9iefqu3
TLSH 80F4DF8EB2448A7AC91C06F49071591103767D3194E1E7BA3CCEB2F627F33D61096E6B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-699630.hostwindsdns.com
Sending IP: 142.11.243.251
From: John<jpue@novonordisk.com>
Reply-To: John<lawren@iatticepower.com>
Subject: May 2020 PO
Attachment: doc_202005127687980,XLS.iso (contains "doc_202005127687980,XLS.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 03:12:28 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dbie32jn7yrhkktqh4mv3fsnymwjtobuc2g3s2qk2hwacb5jngfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 18504de92dfe22752a703f195d964dc32c99b834168db96a0ad1ec0107a9698b

(this sample)

AgentTesla

Executable exe f5de22863415baa10e9e1c81e87e26083a09859c33aac0c30e16d55e140ced20

  
Dropping
MD5 19648296cf732c9d5321d0a6fb13f963
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5de22863415baa10e9e1c81e87e26083a09859c33aac0c30e16d55e140ced20

Comments