MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 381cb62784f183dddad0ad25afc9a90a1f0ac6fa8b55bcef5f910ed9af11fe14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 381cb62784f183dddad0ad25afc9a90a1f0ac6fa8b55bcef5f910ed9af11fe14
SHA3-384 hash: bf0f5683fefe9ea7cbade3cd57c3eca4f86d71381cfd315c78e760e5a65310e82b55e58aec61c00f8198ce5884321b0a
SHA1 hash: 00ab577fcf5e02362933f42d514c169e1011fb8b
MD5 hash: d4e020dc8e3d5671916226667b78b11d
humanhash: north-five-one-fourteen
File name:Quotation_pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:972'800 bytes
First seen:2020-10-12 06:11:37 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:7lrb3Y5lRf8OujxmavUxK48ekyumzJhA:7lrboruOuVmavUU1yVzvA
TLSH B125ADE123948A55D47F87F8403695A353B3661E6C6DD20D3CC6BECF3E72B424112AAB
Reporter abuse_ch
Tags:AgentTesla iso MailChannels


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bonobo.elm.relay.mailchannels.net
Sending IP: 23.83.212.22
From: DOOYANG LINE CO., LTD. <admin@dooyang.com>
Subject: RE: Urgent Request for Quotation
Attachment: Quotation_pdf.iso (contains "Quotation_pdf.exe")

AgentTesla SMTP exfil server:
mail.impressindia.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/381cb62784f183dddad0ad25afc9a90a1f0ac6fa8b55bcef5f910ed9af11fe14/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 04:53:52 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=haolmj4e6gb53wwqvus27snjbipqvrx2rnk3z327sehntlyr7yka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/381cb62784f183dddad0ad25afc9a90a1f0ac6fa8b55bcef5f910ed9af11fe14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 381cb62784f183dddad0ad25afc9a90a1f0ac6fa8b55bcef5f910ed9af11fe14

(this sample)

AgentTesla

Executable exe 042e32eb8970e6dd8e767bb75bc25b3325c314783b9c3bb365727584dba4d918

  
Dropping
MD5 2132a058a978817e75254482ace91dfb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 042e32eb8970e6dd8e767bb75bc25b3325c314783b9c3bb365727584dba4d918

Comments