MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 968e34494208de3992996e671c28f766becf058da94128c404485c22c3f0237d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 968e34494208de3992996e671c28f766becf058da94128c404485c22c3f0237d
SHA3-384 hash: 19a47305f93cb09ac990ea9f55d9f20f1ceb6d55ee9a692cb7fe538e984d0242b52f1c5446d3122d45ebd070087508ae
SHA1 hash: c0607cdad8d9630eaf7aa897ea8495cad77e1d5b
MD5 hash: 1c968292d4a479d0512e2378f645c95d
humanhash: six-oregon-yellow-hotel
File name:QUOTATION_TEM PDF.GZ.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:663'552 bytes
First seen:2020-10-16 17:47:09 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:GGPa51ACJ4KB8994utdizKvyyOJPUYhqL067aw46X:sbKKBu9xtw2vhOJPU4G
TLSH B5E49DBBAA44B62DF95E4C32C89C08E5926CBD5F1F87F307741726C8CE1A151E9B20B5
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: doguselektrik.com.tr
Sending IP: 104.255.168.166
From: Satis<satis@doguselektrik.com.tr>
Subject: Enquiry200810-1 DTG
Attachment: QUOTATION_TEM PDF.GZ.iso (contains "QUOTATION_TEM PDF.GZ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.57460.23690.31525.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/968e34494208de3992996e671c28f766becf058da94128c404485c22c3f0237d/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 10:45:02 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s2hdiskcbdpdteuznztrykhxm27m6bmnvfasrraejbocfq7qen6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/968e34494208de3992996e671c28f766becf058da94128c404485c22c3f0237d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 968e34494208de3992996e671c28f766becf058da94128c404485c22c3f0237d

(this sample)

AgentTesla

Executable exe 6064936e934c6da4c769953688b4ddc4da448563d1f0ea3708548b187c0b880e

  
Dropping
MD5 439ec161b2710acee4057b929023cd82
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6064936e934c6da4c769953688b4ddc4da448563d1f0ea3708548b187c0b880e

Comments