MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 217650103481e1f0cf1021c0ad38cf8fd3b31d6d328544ac6cae9572c9e169e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 217650103481e1f0cf1021c0ad38cf8fd3b31d6d328544ac6cae9572c9e169e8
SHA3-384 hash: c9035811daa1e8270af50f787828af8a44b254ae7b68f539ab8d68e3b7355c6c66403e92674e330e86fcacb001f2d7e4
SHA1 hash: a616bd898f585337cc16e940a345bc670de076c1
MD5 hash: f686d8ef31f65784d9d7914f45843360
humanhash: princess-venus-freddie-mirror
File name:justificante TRF693266763.pdf.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-26 14:03:33 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:8lzdTZ4rjNxG/i/OfFGr6oWAOejn63VlTv4OKhab+Sz:8V/4rjvGiO9C6oNb6oO
TLSH 7B457DB2AD525C6EC57A4F71057785C0FABA17C63F608A0D71AE430C8F12A1BBB5325B
Reporter abuse_ch
Tags:AgentTesla ESP geo iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.buneg.com
Sending IP: 37.46.150.105
From: info@tecnofixmec.es
Subject: Confirme el pago de la transferencia.
Attachment: justificante TRF693266763.pdf.ISO (contains "43234554321234543_PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/217650103481e1f0cf1021c0ad38cf8fd3b31d6d328544ac6cae9572c9e169e8/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 05:25:27 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ef3faebuqhq7btyqehak2ogpr7j3ghlngkcujldmv2kxfspbnhua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 217650103481e1f0cf1021c0ad38cf8fd3b31d6d328544ac6cae9572c9e169e8

(this sample)

AgentTesla

Executable exe 6e89832e1d4e59b88c4731a606567eb52d8037af54c44aa484a5699b32261bbb

  
Dropping
MD5 808b765f91a52e6b2055862583e3bc31
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e89832e1d4e59b88c4731a606567eb52d8037af54c44aa484a5699b32261bbb

Comments