MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5a40dce158a94096e604b5d1c2ebf52d9f54182d98a192d1c3e4a842df9e4ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5a40dce158a94096e604b5d1c2ebf52d9f54182d98a192d1c3e4a842df9e4ef
SHA3-384 hash: dd3ab14ce4b819eaa0809f355ede34dccb39312d8852501b443e5f4f1c623f401b20ef00271478646e66ed4cc077662e
SHA1 hash: 9810d5c83d389201d3d72f9e6e5d805c06dd1c3a
MD5 hash: ab21f594a031f40b511b9bb771d79188
humanhash: nuts-sink-mexico-diet
File name:Swift copy.IMG.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:913'408 bytes
First seen:2020-10-27 10:22:40 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:paHpfr4Ladic6WgN3mHhj4GND1GA1xLPG1+FQk0JkSQBQ1axNoY5/aQ7W1b:wlrEa4xWgN3mHhjJpbfTCZQ5xdBa
TLSH 2C15973DAE8426E3D273E676A0F60187F9E8618673781D4B11C32B486D4AF163E9734D
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: nginxproxy.fleming.events
Sending IP: 195.168.10.2
From: Thaddeus Sewe <Thaddeus@Hanmail.net>
Subject: OVERDUE PAYMENT NOTIFICATION
Attachment: Swift copy.IMG.iso (contains "Swift copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Zmutzy.51.11164.13236.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5a40dce158a94096e604b5d1c2ebf52d9f54182d98a192d1c3e4a842df9e4ef/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 05:30:10 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ywsa3tqvrkkas3tajnorylv7klm7kqmc3gfbsli4hzfiilpz4txq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso c5a40dce158a94096e604b5d1c2ebf52d9f54182d98a192d1c3e4a842df9e4ef

(this sample)

AgentTesla

Executable exe 4197e9badf45fc7e95887c019da1b600984fe4ec12cbea51bf82dfb78b625c7c

  
Dropping
MD5 8fd779860649ed8a2944b3d2b658d4c0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4197e9badf45fc7e95887c019da1b600984fe4ec12cbea51bf82dfb78b625c7c

Comments