MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e08a7040c84a3a17e368f7cc9a7128f9d78d67374c9bc7f7b9fb1791a83c31f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e08a7040c84a3a17e368f7cc9a7128f9d78d67374c9bc7f7b9fb1791a83c31f8
SHA3-384 hash: 5f230556d9f5bdec948dfe2d2d1f1369d2d83cf7e97f7a85291394d49438db01163fbed721a3401e674a6be4eb8bc6cb
SHA1 hash: 812a332bbe963c1483a8f67c197db251c29d24e7
MD5 hash: 3649034448559eeae58c0455145a0e2e
humanhash: william-mike-victor-network
File name:INVOICE ND PACKING.ISO
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-09-02 15:06:48 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:A739mI6aVkxHU6SRO3Qm1gjE1YhplYozRqXg/sf:TVaVeCk3zWYocZ
TLSH 26451200767C5B53C9F687FC20EBB16107B2786A6574D3597CCE21CA0FE6B408E94A6B
Reporter cocaman
Tags:iso


Avatar
cocaman
Malicious email
From: Shirley <shirley@createtheremarkable.com>
Received: from cloud.ehafqatar.org (cloud.ehafqatar.org [67.227.138.5])
Date: Wed, 02 Sep 2020 17:36:48 +0300
Subject: REVISED INVOICE AND PACKING LIST
Attachment: INVOICE ND PACKING.ISO

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e08a7040c84a3a17e368f7cc9a7128f9d78d67374c9bc7f7b9fb1791a83c31f8/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 15:08:11 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4cfhaqgiji5bpy3i67gju4ji7hly2zzxjsn4p55z7mlzdkb4gh4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e08a7040c84a3a17e368f7cc9a7128f9d78d67374c9bc7f7b9fb1791a83c31f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso e08a7040c84a3a17e368f7cc9a7128f9d78d67374c9bc7f7b9fb1791a83c31f8

(this sample)

AgentTesla

Executable exe 93be03ee9522ffc9ea73dcf74bac994a5eabf6f373c0536f5c718af8ff819995

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 93be03ee9522ffc9ea73dcf74bac994a5eabf6f373c0536f5c718af8ff819995

Comments