MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e753400249833cedad02052d7abcb408cf925735bc06a0b75c3bc73b112a4235. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e753400249833cedad02052d7abcb408cf925735bc06a0b75c3bc73b112a4235
SHA3-384 hash: 4e16c483213283d2d529925fd30301dee02a8b5e10c17c2947e6fd6cc1c6cf1140fe0a2259a37da14a7fca62ebce3378
SHA1 hash: c68714e0953e744013a0f8f23f6e3af803688787
MD5 hash: 5665f4f60cdaebbbe9454f6ef69fb16c
humanhash: victor-yellow-montana-sweet
File name:INVOICE_9845018.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'808 bytes
First seen:2020-06-12 06:56:41 UTC
Last seen:2020-06-28 20:56:49 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:6oVFvP7KIWZcOosN+Xb57NGiA+3WsCiRC:6oXWmLsMXbDG83
TLSH 2CB4F18D3690B3AFC467C9369DA41C24AB31B466571BD317B42F11AC9B0F697CF206B2
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.cazumedya.com
Sending IP: 78.142.211.126
From: seguridad@remilsa.com
Subject: URGENT//RE: Invoice overdue for May,28 (last month)
Attachment: INVOICE_9845018.iso (contains "INVOICE_9845018.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.931.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Worm.AutoRun
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:58:10 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=45juaasjqm6o3licauwxvpfubdhzevzvxqdkbn24hpdtwejkii2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso e753400249833cedad02052d7abcb408cf925735bc06a0b75c3bc73b112a4235

(this sample)

AgentTesla

Executable exe 4d9a1d631dce49d1e7e5eddc38dfb09be7bc1386a2f28182ac88af51bced96d0

  
Dropping
MD5 02e4ae48b9b19ca5a15c1c3e6c78664f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d9a1d631dce49d1e7e5eddc38dfb09be7bc1386a2f28182ac88af51bced96d0

Comments