MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fa101bd33669a7dcec25f9678295bddc4815de52e18fa2af68cec70ab5c8762. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fa101bd33669a7dcec25f9678295bddc4815de52e18fa2af68cec70ab5c8762
SHA3-384 hash: 6dcc3f4e8a3625bcda5f05af440318c0a079093cb2845724df4b2b9cc6209984a35814294dba3ff467a1c341166acb8b
SHA1 hash: 0fca7a7d6fe49c03237e9c3b962dad1939fa836d
MD5 hash: 57c284d515c7d8fcd99787f617732587
humanhash: timing-batman-bulldog-white
File name:MO 48812 1046098_Docx.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-11-06 07:22:52 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Waar0jDE44oQ0ndaIUHMiHsRsgrTyPWLR5gsig2nKgdpVZtW9ICu5ei:7aAjw2HUHLss0TYCHgNzdpVHCuYi
TLSH 0B45DF32239C1F65E07EA7B8513124902BF1F4529725E60E7D9C60CD2AB2F469BB2F17
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: farmahem.com.mk
Sending IP: 209.58.149.98
From: Zoran Nastov <zoran@farmahem.com.mk>
Reply-To: Zoran Nastov <info@metra.me>
Subject: Re: SWIFT 05-11-20_669-AU01 VIGLACERA
Attachment: MO 48812 1046098_Docx.iso (contains "MO 48812 1046098_Docx.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.18448.4779.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fa101bd33669a7dcec25f9678295bddc4815de52e18fa2af68cec70ab5c8762/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 03:59:32 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6qqdpjtm2nh3twcl6lhqkk33xcicxpffympukxwrtwhbk24q5ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 4fa101bd33669a7dcec25f9678295bddc4815de52e18fa2af68cec70ab5c8762

(this sample)

AgentTesla

Executable exe 6ea11326c3a5f1868bc3e68659b48bc00a0ac1eaa5941d40c0d0c42c039aad85

  
Dropping
MD5 93b3359513ff91d78d4943f35cba7087
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ea11326c3a5f1868bc3e68659b48bc00a0ac1eaa5941d40c0d0c42c039aad85

Comments