MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d39694224bb45acb1c2410511705f1e7d1ff232d294a53a351eb2798fe447a51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d39694224bb45acb1c2410511705f1e7d1ff232d294a53a351eb2798fe447a51
SHA3-384 hash: 283fb752205aefa41c1f057a82b3dd850a74ef851e6fb5d6aa02887cdaa0c2c495314ffe4bffe93e47f603ad428f813e
SHA1 hash: c048bc934d5c0c9b6f8113f0baf5b8a0aa27c048
MD5 hash: 74aad67a8bd018fcf59aa058b43e3b27
humanhash: nitrogen-louisiana-princess-mountain
File name:Scan G-0034905.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:786'432 bytes
First seen:2021-02-15 16:39:25 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:jEO651+70pKXQlNR6O9KklXpm/rO9+wMI6Ubge11o4X:IQml5mq8Rxeno
TLSH 8FF48D2123D85F5BF07E7775A434240087F3B906E7B6DA6D3DA811DE1B62E80CA62763
Reporter cocaman
Tags:AgentTesla iso


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?TWl0IGZyZXVuZGxpY2hlbiBHcsO8w59lbg==?= <sal.neg@riu.com>" (likely spoofed)
Received: "from riu.com (unknown [212.32.236.219]) "
Date: "15 Feb 2021 07:02:51 -0800"
Subject: "Order Confirmation"
Attachment: "Scan G-0034905.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1756.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d39694224bb45acb1c2410511705f1e7d1ff232d294a53a351eb2798fe447a51/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-15 16:40:10 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2oljiislwrnmwhbecbirobpr47i76iznffffhi2r5mtzr7sepjiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d39694224bb45acb1c2410511705f1e7d1ff232d294a53a351eb2798fe447a51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso d39694224bb45acb1c2410511705f1e7d1ff232d294a53a351eb2798fe447a51

(this sample)

AgentTesla

Executable exe 58fca7f53b148930126a886b687c15d5810557d0034ec75261dbd94c90698031

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58fca7f53b148930126a886b687c15d5810557d0034ec75261dbd94c90698031
  
Dropping
AgentTesla

Comments