MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a31e492abe15644cd6e0c87e9a65985f2fa833faedd39ad27d7ec0dd63b9fc46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a31e492abe15644cd6e0c87e9a65985f2fa833faedd39ad27d7ec0dd63b9fc46
SHA3-384 hash: d727d372e7329f028c2dcb436130e539b5172ab3f19996c0c70fd11ac720547ae479df4690968d5845fac9d69134108a
SHA1 hash: ba6664242fe5ce4814a73b315b766d9e0c72ebf4
MD5 hash: ea82f926176da792c3b6df9192fe8990
humanhash: high-red-east-low
File name:Purchase Order HYTGFBFD.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:958'464 bytes
First seen:2020-06-12 06:50:07 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:HStx9mbkp8JhqlKSLq7wfu+8EZRc9uJpK1LbB7WdtlEksz:yT4Ap8fQsiUE49IMbB7WdtlDsz
TLSH 251528D2F54046EAFD3ACFB45B373A2105E37DED9CA4595CD498F68206E334220BA94B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: whale.dnsracks.com
Sending IP: 69.175.99.245
From: Edwardo<halilcecen@kendigelen.av.tr>
Subject: Purchase Order HYTGFBFD
Attachment: Purchase Order HYTGFBFD.iso (contains "14bvf0hk.3ps.exe")

AgentTesla SMTP exfil server:
mail.impressindia.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis.15794.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:51:08 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=umpeskv6cvsezvxazb7juzmyl4x2qm725xjzvut5p3an2y5z7rda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso a31e492abe15644cd6e0c87e9a65985f2fa833faedd39ad27d7ec0dd63b9fc46

(this sample)

AgentTesla

Executable exe 9e1eb0470f3d916a2f5d92b6cd45bb504284c2e53f26d443a5c54ad1252c4d1d

  
Dropping
MD5 c59e6f3c0b7c6404f15dcf10544721f3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e1eb0470f3d916a2f5d92b6cd45bb504284c2e53f26d443a5c54ad1252c4d1d

Comments