MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d41608559044e79567d8b8a0cc56dc7e86fb3e2c00c1a2181813332e8acafc72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d41608559044e79567d8b8a0cc56dc7e86fb3e2c00c1a2181813332e8acafc72
SHA3-384 hash: 5c670c316eb77521307a52750dd54c8a3a3c7a6adfda7fcb5086df3ae558cee6aa2475c3cd2e84319dc1e9e8e4de8cf8
SHA1 hash: 1ee926b391ad03a9fd803f510a76ba833ec8dccc
MD5 hash: b2a0fe7818a4f953b7e2856e18d83b1b
humanhash: echo-november-berlin-table
File name:swift copy oooooooo.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:786'432 bytes
First seen:2020-10-05 12:06:17 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:mcAt9L2fndhBK2w3p3z+iqiBZdMuWD9gPO8nw:MHqhBFgBg6
TLSH EFF48D22A2E14437C1661A3D9DDB6774DC2ABE503D38A9463FE8DC4C9F396837819393
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server1.citgroupltd.com
Sending IP: 213.246.108.82
From: Jev Montes <jevelio@citgroupltd.com>
Subject: PAYMENT COPY MT103-001-CAT.
Attachment: swift copy oooooooo.iso (contains "swift copy oooooooo.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d41608559044e79567d8b8a0cc56dc7e86fb3e2c00c1a2181813332e8acafc72/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 09:16:00 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2qlaqvmqittzkz6yxcqmyvw4p2dpwprmada2egaycmzs5cwk7rza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d41608559044e79567d8b8a0cc56dc7e86fb3e2c00c1a2181813332e8acafc72

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso d41608559044e79567d8b8a0cc56dc7e86fb3e2c00c1a2181813332e8acafc72

(this sample)

AgentTesla

Executable exe a20e29b157ca333fd7f6503315be7f41df98bf15172c0a8f6cab83451945effe

  
Dropping
MD5 c0ef0a476d473370080192a4941a380a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a20e29b157ca333fd7f6503315be7f41df98bf15172c0a8f6cab83451945effe

Comments