MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c8582bfc6e0ae3559f0266a8780c2a7f712182ca09d60a0c3e4cb1ce5c3dac6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c8582bfc6e0ae3559f0266a8780c2a7f712182ca09d60a0c3e4cb1ce5c3dac6
SHA3-384 hash: 9659a0caace6d212f7c6e85be3efbc6f6a086cccab185b5f80fe4c200986956b9dd2a67b8f7208c7d88cef2dd5661cfd
SHA1 hash: 029f1ef03bdedce80574b8905a55942e7f86581f
MD5 hash: 18d352198f27508b316048aa901d4813
humanhash: cold-may-connecticut-skylark
File name:Payment_Advice.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:774'144 bytes
First seen:2020-07-06 06:28:15 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:a1YTL/g1nOHfmIf6VBi182qqLIjZupd2nP8dRe7kz9hjV3Pqp+xL5mw/xkIeHY8I:agMI/midLKedYUSSZxMmY
TLSH D0F4183C67855805D93C063684B659D1A271BD863A21CB0F3ACA776C6F337DF3A4A386
Reporter abuse_ch
Tags:AgentTesla HSBC iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ngay7.localdomain
Sending IP: 45.127.62.110
From: HSBC Advising Service <advising.service.10236714.856388.2937878154@mail.hsbcnet.hsbc.com>
Subject: Payment Advice - Advice Ref:[GLV701467537] / Priority payment / Customer Ref:[0027739118]
Attachment: Payment_Advice.iso (contains "Payment_Advice.exe")

AgentTesla SMTP exfil server:
mail.friendsgarments.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c8582bfc6e0ae3559f0266a8780c2a7f712182ca09d60a0c3e4cb1ce5c3dac6/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 00:36:21 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fscyfp6g4cxdkwpqezvipagcu73regbmucowbigd4tfrzzod3lda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2c8582bfc6e0ae3559f0266a8780c2a7f712182ca09d60a0c3e4cb1ce5c3dac6

(this sample)

AgentTesla

Executable exe 866ece40ac3cb176771792b217bafb77ef9da017f3962920b46b2d108609fc39

  
Dropping
MD5 68201a663fbe993dabb4852edc56cab2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 866ece40ac3cb176771792b217bafb77ef9da017f3962920b46b2d108609fc39

Comments