MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6eb7b74ec39eea1a0b9f4aa7e956b1cee9fbd96d4b7cc909de553c6b7b8d5d27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6eb7b74ec39eea1a0b9f4aa7e956b1cee9fbd96d4b7cc909de553c6b7b8d5d27
SHA3-384 hash: b10fef277017bf077f10995dda1811173ec362069a61dcf8e406a5cbff7544d4945cf40b0791bf85d559f6892f503d68
SHA1 hash: 5da5c43c7002484496379714bbbc0933a38ea1f0
MD5 hash: 1e979d7d9a3881fc0a2d6a8dffc70e11
humanhash: mississippi-river-fruit-friend
File name:PO3340-22052020.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:636'928 bytes
First seen:2020-05-27 08:24:40 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:LLVeODvyGFP2thYN+eby/Wkc9e1AI3HFAibbKHys59neJ4i0c3M+6D5stI0Bew7z:cODvp+HYN+J/B1P3HFAKKH44ba
TLSH 9AD4DF41656C4BD2E47907F354AA898606222F5E86F9906FBDDFB2E40BB33430507E6F
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.kumarilawyers.com
Sending IP: 162.144.42.75
From: HANIL-FUJI(Korea) CO., LTD. <ccounts@hanil-fuji.com>
Subject: Re: Purchase order: PO3340-27052020
Attachment: PO3340-22052020.iso (contains "PO3340-22052020.exe")

AgentTesla SMTP exfil server:
mail.impressindia.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.300.9512.30429.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 08:37:01 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 6eb7b74ec39eea1a0b9f4aa7e956b1cee9fbd96d4b7cc909de553c6b7b8d5d27

(this sample)

AgentTesla

Executable exe 2a4abd200745105770d74dbf311c5c1b4cfff4ce743cadd3d0cce2060648a119

  
Dropping
MD5 35c5e71f48be7d9def690629f4ccd29f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2a4abd200745105770d74dbf311c5c1b4cfff4ce743cadd3d0cce2060648a119

Comments