MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2caa6f030ba5361a6d86ee2faaed3473b7ea25c5dfae745f9065b3091aae5e60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2caa6f030ba5361a6d86ee2faaed3473b7ea25c5dfae745f9065b3091aae5e60
SHA3-384 hash: ae177b45d4dee434f5c7086928ef0956fe5d37529a680fa9f621d0ddaa9c78dd7d9fc1ecf23d0816e7b2ae7d14f5ebac
SHA1 hash: ffdc32dcbab947f72243517bc0193d650e94785e
MD5 hash: 1b1e230d78c70f312584c340fba076dd
humanhash: item-colorado-uniform-sierra
File name:Part List_bidding.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:641'024 bytes
First seen:2020-08-13 11:21:20 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:A50g/dyW2AFkgkUpiRo21X/dPdwo1ktZM2AMojttx8FdKAQIysNMH6ZtbbYN9jAY:r+GbjRpdXqjqx8KAQrxUsAsHsND
TLSH 6BD4D06A22F4DA09C07BF37892651052B3E77D4B14A1C71A7DDC18C90F327E24666FEA
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Duncan Middlemiss <dmiddlemiss@gki.com>
Subject: RE: Project Status: Bidding Stage_Part List
Attachment: Part List_bidding.iso (contains "Part List_bidding.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.generic.ml.14717.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2caa6f030ba5361a6d86ee2faaed3473b7ea25c5dfae745f9065b3091aae5e60/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 11:23:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsvg6ayluu3bu3mg5yx2v3juoo36ujof36xhix4qmwzqsgvolzqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2caa6f030ba5361a6d86ee2faaed3473b7ea25c5dfae745f9065b3091aae5e60

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2caa6f030ba5361a6d86ee2faaed3473b7ea25c5dfae745f9065b3091aae5e60

(this sample)

AgentTesla

Executable exe 61f179ab9d877a4089f3a2e21db9d62537a9181fe6f58ba81a9eb2b0c45ac3a5

  
Dropping
MD5 36233073fcb133255abb10ea7e1b9040
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61f179ab9d877a4089f3a2e21db9d62537a9181fe6f58ba81a9eb2b0c45ac3a5

Comments