MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34b2b64f8c43d85610921b8181796ab0f14bf1f1ad3999fb16e79588b8264080. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34b2b64f8c43d85610921b8181796ab0f14bf1f1ad3999fb16e79588b8264080
SHA3-384 hash: f350b6403f11eb17935f6fa86a5b9ed752ff85e4951eaeb11679c24c12e6ddb5dbc400ed6a1391fbc910fef9870229c0
SHA1 hash: 4988ae24256f2b92432d02005ff173f9c7ad20e5
MD5 hash: 6912fefbe0b3d6f43e4f5de1141ad986
humanhash: emma-edward-four-potato
File name:IMG_RFQ_7329873892938734.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-07 09:34:35 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:65oJecps5bYV+SYbOjbDrFkipvUQOOOIJEQG1mTK6n2YCOiihoIwGaMaNv2U+BHx:vU+xBrKIzoTvS60b3Pe1Gfl
TLSH 54458CB3322D5F5FC62A09F1B03211700FA89F676158E2E9BDC5E9DE01D0B889A535E7
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: stock.ovh
Sending IP: 54.38.183.94
From: Murray Hill <asilva@octcabos.com.br>
Subject: RFQ_ CGHV96100F2_order
Attachment: IMG_RFQ_7329873892938734.ISO (contains "RFQ_7329873892938734.exe")

AgentTesla SMTP exfil server:
mail.ndfpune.com:587

AgentTesla SMTP exfil email address:
info@ndfpune.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34b2b64f8c43d85610921b8181796ab0f14bf1f1ad3999fb16e79588b8264080/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:36:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gszlmt4mipmfmeesdoayc6lkwdyux4prvu4zt6yw46kyrobgicaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 34b2b64f8c43d85610921b8181796ab0f14bf1f1ad3999fb16e79588b8264080

(this sample)

AgentTesla

Executable exe 33f00dc2af9dacecce6b63438a089cbc245fad566b7533ddf5fffb51c6b3db09

  
Dropping
MD5 9fb3e027806136be32d5c6db94e0ca28
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 33f00dc2af9dacecce6b63438a089cbc245fad566b7533ddf5fffb51c6b3db09

Comments