MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e10f99059cd7d73f86fe23197a6fc49f786779aee99055112d2ca5bf1285d2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e10f99059cd7d73f86fe23197a6fc49f786779aee99055112d2ca5bf1285d2e
SHA3-384 hash: db6f0f61a8a1aae843629a63546bdc3f252c8262cfa5def506b513ffa079236d2d39abebc43e943f15ef214a7326d224
SHA1 hash: d8a0f6ddbf4166a58c207009fe29888bc320a2bd
MD5 hash: 755846f08c4578bf84157c959f591727
humanhash: sodium-saturn-salami-xray
File name:payment.commitment.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'695'744 bytes
First seen:2020-05-28 06:17:48 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:otb20pkaCqT5TBWgNQ7aSVFgm+ut6QfXCr8ylf7mPAlDK7ioIFl6A:xVg5tQ7aSV2+6IZylf7nthj5
TLSH 7D75CF1223BDC667E36E6173791573017E6BF81511A4F8B72FB8893CEA101214E2A76F
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpns3.citechco.net
Sending IP: 203.191.33.193
From: Accounts <info@oilitfsecure.com>
Reply-To: sales@excbag.com
Subject: PAYMENT COPY/BANK DETAIL
Attachment: payment.commitment.iso (contains "payment.commitment.scr")

AgentTesla SMTP exfil server:
mail.pienetwork.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:36:15 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2e10f99059cd7d73f86fe23197a6fc49f786779aee99055112d2ca5bf1285d2e

(this sample)

AgentTesla

Executable exe b195fee151a6483484e21e537b3c4cc62802ce015048fee3425fb70210e74bd0

  
Dropping
MD5 0c59bba8b6c43bfd97ecb60f4fd466ce
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b195fee151a6483484e21e537b3c4cc62802ce015048fee3425fb70210e74bd0

Comments