MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abe0dad2dc4309579c4dc1f09a065a3e29149f60c5cd99a14f0db3d9205b227f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abe0dad2dc4309579c4dc1f09a065a3e29149f60c5cd99a14f0db3d9205b227f
SHA3-384 hash: f3d782a0dad5240ad4bbc1e6daa531f667f6cdd57d84d869324e4ccaef29247ed4eec1046ca502396fe37e9854d50a12
SHA1 hash: 1b434990409f08198df90e294e04fcda2da79862
MD5 hash: 0f82196a5e4cdf36f2287b8d98bb1911
humanhash: mango-blue-west-autumn
File name:EFECO SAUDI LLC -NEW OFFER 210218.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-18 07:40:58 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Ps3wEAMm25HY1Oj7hyINYW9yr+JFeRnPf1RdSEt35yRQ+TUJHr:urm25RHGUo+JFeRf1nSS35ytoJHr
TLSH 9545023AB6AC2C53CF6C51F6E505525A3B76825920DEF3E57ECEA1D832E7B808453813
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: internationalcircuits.com
Sending IP: 37.46.150.69
From: Anas Al Jaber <slin@internationalcircuits.com>
Subject: Request For Quotation
Attachment: EFECO SAUDI LLC -NEW OFFER 210218.ISO (contains "EFECO SAUDI LLC -NEW OFFER #210218.exe")

AgentTesla SMTP exfil server:
smtp.vivaldi.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abe0dad2dc4309579c4dc1f09a065a3e29149f60c5cd99a14f0db3d9205b227f/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 07:41:08 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpqnvuw4imevphcnyhyjubs2hyurjh3ayxgztikpbwz5sic3ej7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/abe0dad2dc4309579c4dc1f09a065a3e29149f60c5cd99a14f0db3d9205b227f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso abe0dad2dc4309579c4dc1f09a065a3e29149f60c5cd99a14f0db3d9205b227f

(this sample)

AgentTesla

Executable exe e9dfce0612e8677dc4cc4e45373c383f300a940789379eaa950fc90dfc85a96c

  
Dropping
MD5 7f5df0d30593bbb7c6f7536475d1dcb9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9dfce0612e8677dc4cc4e45373c383f300a940789379eaa950fc90dfc85a96c

Comments