MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 350c8c8912b7f6de8e1bb1b276e4e4cdb9372b09f9173ab3d8ce3d627c512073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 350c8c8912b7f6de8e1bb1b276e4e4cdb9372b09f9173ab3d8ce3d627c512073
SHA3-384 hash: 1dca9214b46bd49b138a52bd41c6ad1d571fbaf1d21b21d1fc101af0f6b3dff23e91d02a38486d321b7a62163f053c90
SHA1 hash: c773dd6c5b2bf1ab4cc864451cfae6688c32c5b5
MD5 hash: 191349bc504a945ebd6e0ee30afef9a6
humanhash: pluto-crazy-snake-earth
File name:CV_JOB REQUEST_Pdf________________________________________.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'503'232 bytes
First seen:2020-06-08 12:36:03 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:Rtb20pkaCqT5TBWgNQ7a9FgWDYBwsChTmT5xzLzZg/V6A:iVg5tQ7a9FgWDJsYTm1Z3s5
TLSH BD65DF1263DD8365C37E5173BA157701AEBB782905B1F5FB2F98093CEA201211E1E6AF
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: emirates.net.ae
Sending IP: 209.58.149.65
From: Deborah_Fankhauser <postmaster@emirates.net.ae>
Subject: CV_JOB REQUEST
Attachment: CV_JOB REQUEST_Pdf________________________________________.iso (contains "CV_JOB REQUEST_Pdf________________________________________.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:37:06 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gugizcisw73n5dq3wgzhnzhezw4tokyj7eltvm6yzy6we7crebzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 350c8c8912b7f6de8e1bb1b276e4e4cdb9372b09f9173ab3d8ce3d627c512073

(this sample)

AgentTesla

Executable exe a08e9a083658a28c5aa4660f92dbccdbef5dea130a053f0ae6e02d302083528a

  
Dropping
MD5 013fc988f0b740e84dcc8d1d2fb6b198
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a08e9a083658a28c5aa4660f92dbccdbef5dea130a053f0ae6e02d302083528a

Comments