MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f
SHA3-384 hash: 2f8bf52448c21b6db3c8bde1bc84183ae9d98597943bfc7a78f25b2310a4767560eee3c08a57c5d2dc4a15dbf1547f58
SHA1 hash: 8172b9659d1af5c7b85bcf1b7a744659c3292c4e
MD5 hash: db1c7bf0d4e5c8b0f795943bba037eae
humanhash: arizona-thirteen-violet-lake
File name:Invoices.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:104'448 bytes
First seen:2020-12-08 16:37:45 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:qPdwk2Xb0ATnm9bfLEvpittiMtyduA/Uf:qPdCXb0iYTghFdu
TLSH 53A39186370D8E42F6478B347603A3179B97A2433ABB4BB1B5AD13631F535C46A53B83
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cn.fujitsu.com
Sending IP: 156.96.62.55
From: Account Payable <Accounting@cn.fujitsu.com>
Reply-To: dawnimpax2012@gmail.com
Subject: RE: Due Payment Against Invoices
Attachment: Invoices.iso (contains "Invoices.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 08:37:52 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qyau2p2hzphl7u3cgvy7aw3t6pkkrodsfo2wpihpklur5ngbavhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f

(this sample)

AgentTesla

Executable exe 22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827

  
Dropping
MD5 29a6f71888c0eb32d9d22141ebcd643f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827

Comments