MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46018a09f967fbaa7034cf7c37e1f98974ef8375f06f42bde8f35d1651c436ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46018a09f967fbaa7034cf7c37e1f98974ef8375f06f42bde8f35d1651c436ab
SHA3-384 hash: c18ca1831e879460113eb3da3c252afd561052508fcd244e1d44454f8982d7a9c431972456aeba73b304f004e1fc47d7
SHA1 hash: 369ae48e995a1c142c44b5b2908081017f72ee5b
MD5 hash: 96d66c9c72dbccb73aede02a76d8ff7a
humanhash: asparagus-fruit-august-hamper
File name:ORDER_2020889.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:774'144 bytes
First seen:2020-10-13 07:56:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:6ev7BmfbLWqfNhR9yMz+uRJ3szhb9iartNdBojvHMSdiE6Jj:nGmq1htjJ3stl5BgvsSd
TLSH 0EF48E32B2ED5437C167173C9C0B5768D826BE10292868963BEC1D7C5F396B13D1AE8B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alt5.sau-af8a0-or.servercontrol.com.au
Sending IP: 103.13.101.2
From: Sales Ziza Inc <vicentmuske@gmail.com>
Subject: PEDIDO (TOP URGENTE)
Attachment: ORDER_2020889.iso (contains "ORDER_2020889.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46018a09f967fbaa7034cf7c37e1f98974ef8375f06f42bde8f35d1651c436ab/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 06:13:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iyayucpzm752u4buz56dpypzrf2o7a3v6bxufppi6normuoeg2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/46018a09f967fbaa7034cf7c37e1f98974ef8375f06f42bde8f35d1651c436ab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 46018a09f967fbaa7034cf7c37e1f98974ef8375f06f42bde8f35d1651c436ab

(this sample)

AgentTesla

Executable exe 46df88abb8b7f783add8e2688ed3fc2632020fc30f6a87172264a4f434af2524

  
Dropping
MD5 c5916f144ae8501c6f8210453f3110bf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46df88abb8b7f783add8e2688ed3fc2632020fc30f6a87172264a4f434af2524

Comments