MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f
SHA3-384 hash: 3b92fba043101330f97f2048a5f89fa42df6fbda6adff345f795e8c9bf67d2629f013b54e9fddaf83c9a6634c23092ba
SHA1 hash: d28e95b9aa1c2b727d50ce5e31b2ae9c81befcb7
MD5 hash: b9a611562038dfd8f777afa275056b1c
humanhash: muppet-idaho-tennessee-orange
File name:Download_457800_366776_3673636_76638-737979.doc.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:81'920 bytes
First seen:2021-03-11 06:28:00 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 384:UwPBOu6akQit9Ah46EUT2sxi5XrNX3GeD8NR7mUhR:U9JFr9CpT2VhnDehR
TLSH 72830611EAEA9615E43EEE322CE095A41DF7764379B4CA2E300C41495B137C0EE72F76
Reporter cocaman
Tags:AgentTesla DHL iso


Avatar
cocaman
Malicious email (T1566.001)
From: "dhlSender@dhl.com" (likely spoofed)
Received: "from box.gersdet.xyz (box.gersdet.xyz [144.126.212.57]) "
Date: "Thu, 11 Mar 2021 03:08:38 +0100"
Subject: "Emergency Situation Surcharge -Your Package Ready for Pick up"
Attachment: "Download_457800_366776_3673636_76638-737979.doc.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts58.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 06:28:06 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5r67jhz7e4rvikqp3xivfm3oy4xyxor7oxmgcnxmoysvoujug4pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f

(this sample)

AgentTesla

Executable exe 850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28

Comments