MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2
SHA3-384 hash: cf6306d8875f71e2376f1480a21cc85e8262f766e60160d18d47cb9158a186df85be5776f4956fea7928db1bcda5d5b9
SHA1 hash: c870286a5e58099de874a78724b79a69c1692599
MD5 hash: fd7ea841ae685542765a674c8f1f7788
humanhash: lithium-alanine-network-delta
File name:shipping document.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-04 07:18:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:V8LxBjoy2oyOAqwkvfyXDNE5E09BaJp7CulLLcSv:E9O+v6XJwbUJ9d
TLSH 2845125ACBF0E87BD0829DB50EBADA3AF6F6EA0045515747BB7C0E391F806AA47C4501
Reporter cocaman
Tags:AgentTesla DHL iso


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Courier <glenn@trinidad.net>" (likely spoofed)
Received: "from medeortz.co.tz (medeortz.co.tz [196.41.32.157]) "
Date: "Thu, 04 Mar 2021 05:08:51 +0300"
Subject: "New DHL Shipment Document BL,INV And Packing List Attached"
Attachment: "shipping document.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 07:19:10 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dgx6gu6owf6h4gryuqfatnj3bf6vxd5sm3szzhk4bsqiaq2itpja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2

(this sample)

AgentTesla

Executable exe 717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562

Comments