MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40e863bf411dbc1f5e021a612f2131d273cf91fe3b005fa3b13df09b5e3b4145. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40e863bf411dbc1f5e021a612f2131d273cf91fe3b005fa3b13df09b5e3b4145
SHA3-384 hash: f5aa904b8aad6091634a5832af188e6a9ea1037a1b18e31edf46da7658f1793e94d917ea7e5eeecb05d86bf02dd62d35
SHA1 hash: eabd2df9de9c55ed9d28b3630c7657dfc4c6c22a
MD5 hash: 5491c9c1a81fb9f67503cf84a96e6ca0
humanhash: minnesota-skylark-berlin-massachusetts
File name:4019223246.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'044'480 bytes
First seen:2021-02-25 11:10:09 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:AVsJT2fy3BWYR+nwvQILyPB+A+9JqWqi7jDB:CuB0wvngN+Dqg7
TLSH 292539512264AF2CE43D673E9488280E9BFAEC46C326C95B7DFD65DF2BD2F406351206
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gateway5.unifiedlayer.com
Sending IP: 69.89.28.84
From: Kiran S <purchase@lifecarebaniyas.ae>
Reply-To: Kiran S <purchase@lifecarebaniyas.ae>
Subject: REQUEST FOR QUOTATION Patient Name : Sarker Romesh Sarkar Shamol-LC80145848
Attachment: 4019223246.iso (contains "4019223246.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1835.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40e863bf411dbc1f5e021a612f2131d273cf91fe3b005fa3b13df09b5e3b4145/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 11:11:06 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=idughp2bdw6b6xqcdjqs6ijr2jz47ep6hmaf7i5rhxyjwxr3ifcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 40e863bf411dbc1f5e021a612f2131d273cf91fe3b005fa3b13df09b5e3b4145

(this sample)

AgentTesla

Executable exe 369d92b64ee7b40f1679b98499e6d2b3470f9d477a8c35256508ae5715516194

  
Dropping
MD5 87e6882bcebf4823afb4303aac3628b1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 369d92b64ee7b40f1679b98499e6d2b3470f9d477a8c35256508ae5715516194

Comments