MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2c142c10940a4d7aa856d17ce833d03549752afb8c535cb16de8714d1750bf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2c142c10940a4d7aa856d17ce833d03549752afb8c535cb16de8714d1750bf6
SHA3-384 hash: f5bbefd825db8cc49b7888ddbd850a9001a886d832674f9d37f8c0b818be499f0cea845eb5c948c6554f08295e6c3c78
SHA1 hash: 8699952822a3e8baa1f2d1a390dccdc3f016dab1
MD5 hash: bfb380e3eacbe2b089ede2a751c5f182
humanhash: mike-chicken-rugby-alanine
File name:CV-JOB REQUEST______pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:659'456 bytes
First seen:2020-08-27 05:46:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:654CqsHUBvx0dk2NonQNTBHDyi4TPXQjNWPicdHVCR6R6H:654TsHUkZNoQNTRGi4TPA01dH2j
TLSH 6AE40261037C9F21D5FE0BB9A4AD320453F23C5594B5E35DBA8CE26E2BE7B418421B93
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: omsairamlogistics.com
Sending IP: 49.248.66.174
From: Nitheesh Thomas<anantapur@omsairamlogistics.com>
Subject: CV-JOB REQUEST
Attachment: CV-JOB REQUEST______pdf.iso (contains "CV-JOB REQUEST______pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FYV557783500374.2821.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2c142c10940a4d7aa856d17ce833d03549752afb8c535cb16de8714d1750bf6/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:48:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6laufqijicsnpkufnul45az5ankjouvpxdctlsyw32drjulvbp3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f2c142c10940a4d7aa856d17ce833d03549752afb8c535cb16de8714d1750bf6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso f2c142c10940a4d7aa856d17ce833d03549752afb8c535cb16de8714d1750bf6

(this sample)

AgentTesla

Executable exe 6369c4ecf6b92f0422709d58d83bd452d472cbe91ec3980b4110d47413deef8e

  
Dropping
MD5 557783500374290c53462a1df11e9ac4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6369c4ecf6b92f0422709d58d83bd452d472cbe91ec3980b4110d47413deef8e

Comments