MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b37fccb6fef51d3f4132a9385711d1f91be780b3d48b44da83fdd8a1099a6b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b37fccb6fef51d3f4132a9385711d1f91be780b3d48b44da83fdd8a1099a6b3
SHA3-384 hash: f5c7cb49f8862e2f34b1fc2ccfad0306c728c625f48c524665cc3ec2ae4d023914577c67b34f33c416480d1fe6251a7f
SHA1 hash: fedf0be2e78b860cc0b7e21caba08abcf0ac556e
MD5 hash: abb7f9f8307a442c5f7029ee274e0244
humanhash: jersey-oscar-spaghetti-helium
File name:New Purchase Order (1).iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:339'968 bytes
First seen:2020-10-04 08:21:34 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:hr22YGyoe20sSysESzMMO1gNCz/1NeSDOydFc:TYGyowkS3O1r5m
TLSH 9D743A1D72A8A08EF4BB1E705D69F02003727ABE5492DE0D7C9E365E5BF370058593AB
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Marco Meneghetti <service@pumpsukltd.co.uk>"
Received: "from pumpsukltd.co.uk (unknown [216.198.92.45]) "
Date: "03 Oct 2020 12:05:20 -0700"
Subject: "New purchase Order_0023"
Attachment: "New Purchase Order (1).iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b37fccb6fef51d3f4132a9385711d1f91be780b3d48b44da83fdd8a1099a6b3/
Threat name:
ByteCode-MSIL.Trojan.Zeus
Create hunting rule
Status:
Malicious
First seen:
2020-10-03 04:14:51 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nm37zs3p55i5h5atfkjyk4i5d6i346alhvelitnih7oyueezu2zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6b37fccb6fef51d3f4132a9385711d1f91be780b3d48b44da83fdd8a1099a6b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 6b37fccb6fef51d3f4132a9385711d1f91be780b3d48b44da83fdd8a1099a6b3

(this sample)

AgentTesla

Executable exe eddfeca548fc1464fd8937442f58b868ade0a2a5b9a2780384cf622124b35c71

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eddfeca548fc1464fd8937442f58b868ade0a2a5b9a2780384cf622124b35c71

Comments