MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 263dfd3daee3bc939b5c4ea76d72e00b607ed47dadfeb2473d0a1576da2fed15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 263dfd3daee3bc939b5c4ea76d72e00b607ed47dadfeb2473d0a1576da2fed15
SHA3-384 hash: c3159023ece63066c842807d10111dc6a72c06e060f5e3ff151b2a8099b69b29dfb5b5e2105e487abcbd529d62393a01
SHA1 hash: 0904ac7e4deda975e417e8f72b12feabacb5e9d0
MD5 hash: 8fbf846b1b7429e63b094cdffb46f8cb
humanhash: river-ten-bakerloo-happy
File name:P-Order.4029530.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'525'760 bytes
First seen:2020-06-15 13:09:33 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:6AHnh+eWsN3skA4RV1Hom2KXMmHa+UQaoTE8T2EoyjQY5RVE395:Nh+ZkldoPK8Ya+UCE8T2EoPQVQ
TLSH C665CE0273929036FFAE92739F55B20156BD7929013394FF22981DB9A9701B11F2D3AF
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: import1@clsteam.pk
Subject: Official purchase order (PO.4029530)
Attachment: P-Order.4029530.iso (contains "P-Order.4029530.scr")

AgentTesla SMTP exfil server:
mail.zamangroup.com.bd:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:48:01 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ey672pno4o6jhg24j2tw24xabnqh5vd5vx7lerz5bikxnwrp5ukq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 263dfd3daee3bc939b5c4ea76d72e00b607ed47dadfeb2473d0a1576da2fed15

(this sample)

AgentTesla

Executable exe 0f194d27286796ac0d0c1150fab1425c00dd949a726251fd3fc4d79a27eae085

  
Dropping
MD5 1f3fa5c7a721db8392ad2251cc280daa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f194d27286796ac0d0c1150fab1425c00dd949a726251fd3fc4d79a27eae085

Comments