MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34920f5af341d4a6573170820cc11bdbb3d764996bbbdca5d0d964d7080fba6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34920f5af341d4a6573170820cc11bdbb3d764996bbbdca5d0d964d7080fba6b
SHA3-384 hash: 42190a009a335c0c5193b8204cc51d8a8c5d7afd140c689321b5de6155c4d36f9a4cd72c8895f194a6e0f5f7231dbd8a
SHA1 hash: 3b97df5a60617472f17c81ca483904b50220d2a2
MD5 hash: 1ade81c1dd36d1e9e34519c4e0c3c4a3
humanhash: diet-network-december-juliet
File name:Reconfirm your IBAN.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-07 17:26:16 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:gSFpjMPz9BoDrsUXsvmfECt63rMqvD/9z4dSJ4mKgfUEprkf1z23aCVBiECk7A:gSFpjQA3XsOfEz3N4IJn8zk7A
TLSH 71451A3CB782A419CE3D053248A95DD1F6B0A5873B02CB4F39CA576C6E027DF7B46299
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: merlo.com
Sending IP: 37.49.224.164
From: office<info@merlo.com>
Subject: Reconfrim Your IBAN
Attachment: Reconfirm your IBAN.iso (contains "Reconfirm your IBAN.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENSB.21655.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34920f5af341d4a6573170820cc11bdbb3d764996bbbdca5d0d964d7080fba6b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 17:28:06 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gsja6wxtihkkmvzrocbazqi33oz5ozezno55zjoq3fsnocapxjvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 34920f5af341d4a6573170820cc11bdbb3d764996bbbdca5d0d964d7080fba6b

(this sample)

AgentTesla

Executable exe 571d91bcbedea2198fed6ad8433d7faeaa9add927022c32dc2cce088e781263c

  
Dropping
MD5 e466396cdd8c13b7d720b275e4c16b05
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 571d91bcbedea2198fed6ad8433d7faeaa9add927022c32dc2cce088e781263c

Comments