MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6136d081df0c6e7f3305a8a19c41131528194a084bb912cfd816639d6a036c99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6136d081df0c6e7f3305a8a19c41131528194a084bb912cfd816639d6a036c99
SHA3-384 hash: 64c24334bf028d4e8e275b5abdec2172ff79bc939f220884b25327496802706324d24cb803e72f0bc0395485c1677234
SHA1 hash: 966c2771502952163385cb6bf2df15d6f8c5b9ad
MD5 hash: 6bdd8203e9448b6c6751b3a120f2a501
humanhash: shade-two-helium-paris
File name:PO2001288DV pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:188'416 bytes
First seen:2020-10-12 19:19:22 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:iPjuWw0hjcjLlFWuoEoBMHp62HKPx3xJJd2UA6UAJct3FMEnv22hnbp/SUfL:yw0hIlMGEoN/
TLSH 01042011F305FC96E42712394877E82521B7AAB65672800E38DE365DCBA335634BBDCB
Reporter abuse_ch
Tags:iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mta1.worldwideltd.ga
Sending IP: 192.119.67.35
From: Dominic Maschek<sales@worldwideltd.ga>
Subject: Enclosed PO2001288DV (MASCHEK)
Attachment: PO2001288DV pdf.iso (contains "PO2001288DV pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader34.65085.29313.4033.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6136d081df0c6e7f3305a8a19c41131528194a084bb912cfd816639d6a036c99/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-12 18:36:06 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=me3nbao7brxh6myfvcqzyqitcuubssqijo4rft6yczrz22qdnsmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6136d081df0c6e7f3305a8a19c41131528194a084bb912cfd816639d6a036c99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 6136d081df0c6e7f3305a8a19c41131528194a084bb912cfd816639d6a036c99

(this sample)

AgentTesla

Executable exe a9b25af5375aebc414264faff8068a6848607b660ef951eee0357799e25d6740

  
Dropping
MD5 d12befe3fa6ca8ee3f3c034d673d9bc9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9b25af5375aebc414264faff8068a6848607b660ef951eee0357799e25d6740

Comments