MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6832304edd29283681e38daa833d55c3e1eb3c318961bd5742cc2ca2fc98ad63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6832304edd29283681e38daa833d55c3e1eb3c318961bd5742cc2ca2fc98ad63
SHA3-384 hash: 5b2388b258bd007382a561f2d28ead79969b5cccf3abca7581cc24c1b17e9bc6be02c4483f816733b372ce628b6759de
SHA1 hash: 3aebe49b479b8cd1a5196135f4d4c8acf45dddb3
MD5 hash: 180a5bbff55fe01f1f6ae4bb9395cbe0
humanhash: solar-july-angel-oxygen
File name:INV-98765445.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'507'328 bytes
First seen:2021-02-23 06:36:32 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:z26HekkeKiUOg20jPQ/Svrh6f1NpQansF1yRL0LEZ50cN7qRCFcZPhrGxm+uqTSb:zJKiUbrjPOTq1FURkEZbBqRycZisj
TLSH 4865AE126A886FADF07EA7355018940E9BF5F512D335D95F7D9620EB0EB2F0087A1E23
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Accounts Department <nabtrin@trinidad.net>" (likely spoofed)
Received: "from trinidad.net (unknown [84.252.95.65]) "
Date: "22 Feb 2021 19:37:44 -0800"
Subject: "Invoice NO_8877"
Attachment: "INV-98765445.ISO"

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6832304edd29283681e38daa833d55c3e1eb3c318961bd5742cc2ca2fc98ad63/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 05:45:11 UTC
File Type:
Binary (Archive)
Extracted files:
72
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nazdatw5feudnapdrwvigpkvypq6wpbrrfq32v2czqwkf7eyvvrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/6832304edd29283681e38daa833d55c3e1eb3c318961bd5742cc2ca2fc98ad63

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 6832304edd29283681e38daa833d55c3e1eb3c318961bd5742cc2ca2fc98ad63

(this sample)

AgentTesla

Executable exe 77dafc4c23c98c2d0518eb6bcee7cfc13128c249dafc4d5faefbfb67425f40e1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77dafc4c23c98c2d0518eb6bcee7cfc13128c249dafc4d5faefbfb67425f40e1
  
Dropping
AgentTesla

Comments