MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc45b79bb88cbf178d6645cc3309f284e967d181c00bdd5ce853673e0618e70a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc45b79bb88cbf178d6645cc3309f284e967d181c00bdd5ce853673e0618e70a
SHA3-384 hash: 0fa0269b0b834e514d28c668481d696262af77c682629c6a345f635e329908cf7631adc78eab671016b01372dcfa21b3
SHA1 hash: 1fb2870586c7fcd71ef7cf925668f25bfe22e55c
MD5 hash: 49b51b7e39672059ba22378d17d6f7a7
humanhash: echo-cup-mountain-bakerloo
File name:2020-08-05_2020-08-05_B00000303287_K71223.PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:354'304 bytes
First seen:2020-08-06 05:24:55 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:jN+8537H8ZfxxtblMiA6w7nvm/MPIiWWartnaC9OBerN:jl4TxtblMTlnv9AiSrtnaC9OB
TLSH 8274AD05F1884525D86C28348E9B8A5013F6BD83D7718E2DBBDCBC56AF329B57C0E2D9
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.begmalk.com
Sending IP: 104.168.175.61
From: Andreas Buring<buring_wsd@wsd-gotha.de>
Subject: OrderB00000303287
Attachment: 2020-08-05_2020-08-05_B00000303287_K71223.PDF.iso (contains "2020-08-05_2020-08-05_B00000303287_K71223.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EOHWtr.20647.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc45b79bb88cbf178d6645cc3309f284e967d181c00bdd5ce853673e0618e70a/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:26:08 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrc3pg5yrs7rpdlgixgdgcpsqtuwpumbyaf52xhikntt4bqy44fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cc45b79bb88cbf178d6645cc3309f284e967d181c00bdd5ce853673e0618e70a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso cc45b79bb88cbf178d6645cc3309f284e967d181c00bdd5ce853673e0618e70a

(this sample)

AgentTesla

Executable exe d28d5eb6ef6a35c2323f5b10e3bd013eff3338197df93c562dd55455b9ab4911

  
Dropping
MD5 695f814454972a685e1162e9b5629f32
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d28d5eb6ef6a35c2323f5b10e3bd013eff3338197df93c562dd55455b9ab4911

Comments