MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3456f02a4372b8b702cf8661d009098a9e493211e59e9489d215d734146c7cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3456f02a4372b8b702cf8661d009098a9e493211e59e9489d215d734146c7cc
SHA3-384 hash: 0ceb67923a7f362501821ec31f26be287dd79845d317439574ccaabd586b74fdc46cf08e0db92ef40464b6e3b2e40f94
SHA1 hash: 09da39a7216dd9b343a172abad78b8d59589812d
MD5 hash: c8a4b78e2567fc6ed745adc3ec2e1f00
humanhash: table-sweet-bluebird-north
File name:PO24344.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-09-24 18:22:00 UTC
Last seen:2020-09-25 05:21:20 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:uw6S2j8oB7ZOFANWfPs7Wmt5uaBMvl+D3IWTshF0po7:uwmh7Zsd1mtAaBMNh9hF0p0
TLSH 57452927A1074421C81853BA0D2BEFF461929FF71A63EB5B23E57E6BFE71C9B1615008
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: ""Vivekanandar Saalai" <postmaster@mail-setuptransfer.in.net"
Received: "from cart-expiredsession.in.net (hwsrv-780832.hostwindsdns.com [192.255.235.109]) "
Date: "None"
Subject: "Kindly give your quotation."
Attachment: "PO24344.ISO"

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.21336.2864.2252.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3456f02a4372b8b702cf8661d009098a9e493211e59e9489d215d734146c7cc/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 02:15:11 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yncw6aveg4vyw4bm7btb2aeqtcu6jezbdzm6sse5efoxgqkgy7ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso c3456f02a4372b8b702cf8661d009098a9e493211e59e9489d215d734146c7cc

(this sample)

AgentTesla

Executable exe 680140d3154a46f700e8df74a9273a193afce6fe7a1cd532672b18424a9b0da9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 680140d3154a46f700e8df74a9273a193afce6fe7a1cd532672b18424a9b0da9
  
Dropping
AgentTesla

Comments