MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6684fcfb8336c8853b27b6ab9a75f92b7b69fb65c5aa1eb6850747b630e6725c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6684fcfb8336c8853b27b6ab9a75f92b7b69fb65c5aa1eb6850747b630e6725c
SHA3-384 hash: 871b124d85b778d87c3c2526328249cab40516e17dbddbf856c557f8767e881fc78e12f2d59fb6be84049f454744dde9
SHA1 hash: f568314e40e794ec9ab3dd0122713f74ae0b8da7
MD5 hash: 608107b29d6290726208fa4ff3ead171
humanhash: butter-eighteen-football-minnesota
File name:2020.8.5RFQ867.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2020-08-05 12:03:36 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:uVQTURrD0o+UcvaWgR8RF85XMMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMM4:eQTURr4o32g3MMMMMMMMMMMuMMMMMMMP
TLSH EE557DA0B06128A3CFB846F52906E9344B653EACA09DD2F52CDD7CDF76F6F620542813
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: heyserver1.heyhost.com.br
Sending IP: 186.233.184.42
From: "Pavel SÎRBU" <psirbu@basadoro.md>
Subject: New Purchase Order: 2020.8.4RFQ867
Attachment: 2020.8.5RFQ867.ISO (contains "2020.8.5RFQ867.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.24916.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6684fcfb8336c8853b27b6ab9a75f92b7b69fb65c5aa1eb6850747b630e6725c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:05:18 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m2cpz64dg3eikozhw2vzu5pzfn5wt63fywvb5nufa5d3mmhgojoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6684fcfb8336c8853b27b6ab9a75f92b7b69fb65c5aa1eb6850747b630e6725c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 6684fcfb8336c8853b27b6ab9a75f92b7b69fb65c5aa1eb6850747b630e6725c

(this sample)

AgentTesla

Executable exe c32ac26ceb3ea5b87c5187682cd69d3c1b58ed9362aa8660e3ec8d9d07d4f5a5

  
Dropping
MD5 b2b6a67179dc07b26e8069a4e290876a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c32ac26ceb3ea5b87c5187682cd69d3c1b58ed9362aa8660e3ec8d9d07d4f5a5

Comments