MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25b808cebf37e56124fd7cdcb75e929350aa2d9bd355149ce96f3dce7b415606. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25b808cebf37e56124fd7cdcb75e929350aa2d9bd355149ce96f3dce7b415606
SHA3-384 hash: 5c87122e54651a96049c576901d313e3a59f78be34924550be3a62e98edd52efb56136cc51586fe19c908d52004dcaf8
SHA1 hash: 52702dfee0dba8d0d1d7c441a47712d03034d11c
MD5 hash: 7f5c552b2116ffaa98292308a61df020
humanhash: grey-monkey-fanta-carbon
File name:305930960MN.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:485'376 bytes
First seen:2020-06-24 05:18:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:0hY1//2F2TpspGXSADvazcRsFk5WjTcupmlRA7z87OsokV3tEb5XYwg37z6:0u2F2GOec15k4uwlRmz87Zkuz
TLSH 8BA4021077E85666FAADDB7804327240633B7A5A69B3D30C7D8D645E1F27B809A80F37
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mailhost05.i3c.co.ug
Sending IP: 169.55.55.221
From: info@slau.ac.ug
Subject: Re: new order No.305930960MN
Attachment: 305930960MN.iso (contains "305930960MN.exe")

AgentTesla SMTP exfil server:
mail.cabseal.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WMH.613.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25b808cebf37e56124fd7cdcb75e929350aa2d9bd355149ce96f3dce7b415606/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:20:06 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ew4artv7g7swcjh5ptoloxussnikulm32nkrjhhjn464462bkyda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 25b808cebf37e56124fd7cdcb75e929350aa2d9bd355149ce96f3dce7b415606

(this sample)

AgentTesla

Executable exe 96be4c022a685da66e80a8a7ef911b33bcf3c96116e927faedbfe7f35f483c8b

  
Dropping
MD5 4b61f13282a58c019ed3560566373510
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96be4c022a685da66e80a8a7ef911b33bcf3c96116e927faedbfe7f35f483c8b

Comments