MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e7f7fb9d48deac2f8c16756788c27eb6209b1ed113580290a85e7fb8a094cbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e7f7fb9d48deac2f8c16756788c27eb6209b1ed113580290a85e7fb8a094cbb
SHA3-384 hash: 36df8f4941262579aea2b7f62893ce87986df0ee39f6b6e8e7272912fb7d80f2f0e1a7265f8242a58bedbdd0875cbdff
SHA1 hash: c1f38c456a9bdb4304f608a8bbfc5157353ae051
MD5 hash: 7f17e82eb778c426be078031c588fead
humanhash: oranges-december-robert-uniform
File name:FACTURA_FISCALA-RO81061402-6403840980PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'179'648 bytes
First seen:2020-08-04 11:14:35 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:2SJRyTPtD8HOJrTGBuMq1V5p4wJ8hkdTq8qaHKCdg8tmxS3D4/uG3aaAJVg:2+Ry98H2GBuJVJZIac8toSz5Gy
TLSH 10459DC2F140D951C95A4E36CD67DA9483337C66FF479B063088BA2B39E31D39E266C6
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns5.piensanet.com
Sending IP: 91.121.181.22
From: Nicoleta Novac <Nicoleta.novac@ro.dsv.com>
Subject: DSV Solutions SRL (RO1) - Otopeni - FACTURA FISCALA - RO81053473 - 6404585917 - STAD81272405
Attachment: FACTURA_FISCALA-RO81061402-6403840980PDF.iso (contains "FACTURA_FISCALA-RO81061402-6403840980PDF.exe")

AgentTesla FTP exfil server:
ftp.solarcenter.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.Bladabindi.14667.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e7f7fb9d48deac2f8c16756788c27eb6209b1ed113580290a85e7fb8a094cbb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:16:10 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nz7x7oourxvmf6gbm5lhrdbh5nratmpnce2yakikqxt7xcqjjs5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e7f7fb9d48deac2f8c16756788c27eb6209b1ed113580290a85e7fb8a094cbb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 6e7f7fb9d48deac2f8c16756788c27eb6209b1ed113580290a85e7fb8a094cbb

(this sample)

AgentTesla

Executable exe 98c7f4edb36e0d90ebd8d9aa17a5ac6f29003ed677464bdc05b19b2f17bc62ca

  
Dropping
MD5 71ab275be47c8b8627b92a1b966c337e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98c7f4edb36e0d90ebd8d9aa17a5ac6f29003ed677464bdc05b19b2f17bc62ca

Comments