MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72e7cbdd9698522da65f6192b76b253272aca69110c851fcc685dd0717dcc9fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72e7cbdd9698522da65f6192b76b253272aca69110c851fcc685dd0717dcc9fe
SHA3-384 hash: 74fa4bee088ab51fe34bea3679b391f7eb7f0c74ed5c76d70513f2f3856692def76f38686a335e768e8c03bf83abcf7a
SHA1 hash: 92245054c22db901fe5f586dcc29579fe33bb90d
MD5 hash: 95608a4faa4f3170b160c2c8237b2bb1
humanhash: west-september-nineteen-ink
File name:MT103_7646454TWERTY.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'490'944 bytes
First seen:2020-06-15 05:39:05 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaN+QG8vhzD0K+AubN5jJrEme+mc5:gh+ZkldoPK8YaN+F8vV0K+9nJq+V
TLSH CD65CE0273D5C036FFAB92739B6AF20156BD79254133852F23982D79BA701B2263D763
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outlook.com
Sending IP: 103.147.184.73
From: royalhash4sale@outlook.com
Subject: Swift Payment Copy - Incorrect Bank Details provided
Attachment: MT103_7646454TWERTY.iso (contains "MT103_7646454TWERTY.exe")

AgentTesla SMTP exfil server:
dal-shared-56.hostwindsdns.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:41:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=olt4xxmwtbjc3js7mgjlo2zfgjzkzjurcdefd7ggqxoqof64zh7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 72e7cbdd9698522da65f6192b76b253272aca69110c851fcc685dd0717dcc9fe

(this sample)

AgentTesla

Executable exe 1288e82cd94277f4fa087f5f8f7c8aaefda56da0f734953321e1b45cb3046951

  
Dropping
MD5 8e6d5d7a62f5e6a40dd718789cc7e6ee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1288e82cd94277f4fa087f5f8f7c8aaefda56da0f734953321e1b45cb3046951

Comments