MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44f1fe1c792f22134d7a750cf372c13919edf6b72c34e5856284a0d635d513e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44f1fe1c792f22134d7a750cf372c13919edf6b72c34e5856284a0d635d513e4
SHA3-384 hash: 7aa652388e1f801407e21003548d8796c5b2e11abaa59145e0ad6b7d004579325a498641328996abed9a27bd7d2a65b2
SHA1 hash: 9325c2e78a52adc01c2025025a8758112f42d15b
MD5 hash: ae5b84cdc6d00c3c851973027cc2b864
humanhash: december-earth-sodium-may
File name:Scan 1024765010.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'863'680 bytes
First seen:2020-05-04 21:37:51 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 49152:RVg5tQ7acigp6ibdANrLmhokNt2csEJ2oZ/f5:fg56Wgp9borSmkN5tZ/
TLSH DE85E11223DD8360C77E52737A55B7016E7B782925A1FC7B2FF8093DA9101225E0E6AF
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: roma.com
Sending IP: 173.82.245.49
From: dortha@athenafood.com
Subject: RE: New Order (PO Ref: 1024765010)
Attachment: Scan 1024765010.iso (contains "Scan 1024765010.scr")

AgentTesla SMTP exfil server:
mail.logosbd.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 17:08:04 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ity74hdzf4rbgtl2ougpg4wbhem635vxfq2olblcqsqnmnovcpsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 44f1fe1c792f22134d7a750cf372c13919edf6b72c34e5856284a0d635d513e4

(this sample)

AgentTesla

Executable exe db30ea0612dbb1b6060711f5fc0b226fc1d7e753fac84aa0e3ebb100357f5d48

  
Dropping
MD5 8d1baff56cff79682f80755fc4e35126
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db30ea0612dbb1b6060711f5fc0b226fc1d7e753fac84aa0e3ebb100357f5d48

Comments