MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba2ba437183b6cf78cc08b24997e0d690c68948deb177a0731ba45a263ac6da0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba2ba437183b6cf78cc08b24997e0d690c68948deb177a0731ba45a263ac6da0
SHA3-384 hash: 919c8614b45bc7189c2f41d15239acd608d6351c212531fee72b2c0117079cf7cf05320f354333bc2578ef2c9b37b855
SHA1 hash: 5f98f1c75c50339db73cda5b112616cacfd636d7
MD5 hash: 3253c7688999cb9e213d780bfbe883c9
humanhash: robert-hydrogen-yankee-jupiter
File name:PRODUCT ENQUIRY-No200769.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:4'044'800 bytes
First seen:2020-10-21 08:01:17 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 98304:yw/90gCDGoUDT8zg1+A96ADhAwJ51/AJcz91D:ywytSx8G+AgchJ5qOzfD
TLSH B61612983DD13AAED1E7CD368D981C30AA2034E75327D21B705B62AD9A0C5D7DF186B3
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: uzlinshpl01.uzcloud.uz
Sending IP: 185.74.4.8
From: ptl@crrt.uz
Subject: PRODUCT ENQUIRY
Attachment: PRODUCT ENQUIRY-No200769.iso (contains "PRODUCT ENQUIRY-No200769.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.31490.16692.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba2ba437183b6cf78cc08b24997e0d690c68948deb177a0731ba45a263ac6da0/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 18:31:24 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xiv2inyyhnwppdgarmsjs7qnneggrfen5mlxubzrxjc2ey5mnwqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso ba2ba437183b6cf78cc08b24997e0d690c68948deb177a0731ba45a263ac6da0

(this sample)

AgentTesla

Executable exe d6b229f25b3f185395e58f98c048cad58d929c7a25e6b95319d27da5f5292588

  
Dropping
MD5 6d314f246780558ad1b441585bc940b6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6b229f25b3f185395e58f98c048cad58d929c7a25e6b95319d27da5f5292588

Comments