MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 773c3acbd7c181c9a731a8b193042c7b35cccdd0d2d4e7240c5cff97539525f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 773c3acbd7c181c9a731a8b193042c7b35cccdd0d2d4e7240c5cff97539525f3
SHA3-384 hash: c423b48b5da82475de079f68e2b56ae5fb455e7372517ea04e5887d3cdc7fdaaaba6fe29b5a4fa916f05c5de422f3e43
SHA1 hash: 9f5840215ec585f082b0f77e955d1457afc971a1
MD5 hash: b60b072e6541ed6918fc69c3b594346c
humanhash: two-freddie-carolina-cola
File name:Payment swift copy.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:634'880 bytes
First seen:2020-07-29 06:30:44 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:gjL93jOb1a2xaLBN6g+b27F1N5R85mxe7+In:gHob1ZDkocx
TLSH 45D4F10521985B1FC75A91B97027C1F01223D4A9EBAAEEB75D8FE0971AC22FD34C3257
Reporter abuse_ch
Tags:AgentTesla HSBC iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gg0.514.strinoemenker.ml
Sending IP: 139.59.33.79
From: HSBC BANK <noreply@hsbc.co.uk>
Subject: Payment Advice 29/07/2020- Advice Ref:[SWFA81091000] / ACH credits / Customer Ref:[HX185310812321] / Second Party Ref:[08]
Attachment: Payment swift copy.iso (contains "CH.exe")

AgentTesla SMTP exfil server:
smtp.elittacop.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/773c3acbd7c181c9a731a8b193042c7b35cccdd0d2d4e7240c5cff97539525f3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:32:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o46dvs6xyga4tjzrvcyzgbbmpm24ztoq2lkoojamlt7zou4vexzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 773c3acbd7c181c9a731a8b193042c7b35cccdd0d2d4e7240c5cff97539525f3

(this sample)

AgentTesla

Executable exe d64ac90e87e3bb79fcf3c6285e9c0060b709ac891efb053c78dad54477135adb

  
Dropping
MD5 cd6f408b3e94c0bb69e7081bad538ee2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d64ac90e87e3bb79fcf3c6285e9c0060b709ac891efb053c78dad54477135adb

Comments