MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5
SHA3-384 hash: 6dd474b41ca0ab2a7bffa8f4af3dec72bad902ff2c00ad819c1325e607452e518350375b4ae040448e7f12f024f0d300
SHA1 hash: a005ab549fd5e621a53c2df1fdb266692a4fba9d
MD5 hash: 44256a6eac3035769b3b1ab5311cac74
humanhash: uncle-mango-louisiana-juliet
File name:SWIFT.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:585'728 bytes
First seen:2020-11-26 16:10:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:WGb4JO3VrN2iNMLnstkIoD7WHKv1Gsfv1M66roHIt8LF:bb4JO3BN1gnnuH61Gsi6Xs8
TLSH F8C4F1322692BF96D77A0FF1E56132401FBA79679630E61C7DCC01CE2362B588A15B73
Reporter cocaman
Tags:AgentTesla iso SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "Sun Kyeong Yeon <syeon@ra.rockwell.com>" (likely spoofed)
Received: "from ra.rockwell.com (unknown [185.222.58.144]) "
Date: "26 Nov 2020 08:07:30 -0800"
Subject: "RE: Payment: Draft TT Wire Transfer Copy - For Your Approval"
Attachment: "SWIFT.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 05:58:50 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sosesmwj62kqhq6giutp2oj7d6ea5dkmsaqrre4osrqr6g4fgosq._file
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/93a44932c9f6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5

(this sample)

AgentTesla

Executable exe 75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a
  
Dropping
AgentTesla

Comments