MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2f340996bc2a0e0ed96c89d3a4849439bd6b7df21df3ffe675b920c6740a983. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2f340996bc2a0e0ed96c89d3a4849439bd6b7df21df3ffe675b920c6740a983
SHA3-384 hash: dffcf1f368c84fa6de403eacd3e9062a1da7ddcaa49ee02d6129a527e9a2288b2e2332cdced8030d45b16709c3e39066
SHA1 hash: c9690d5cf39a39783112a5e4e681f99315c0c50e
MD5 hash: 82ed82849e681d6d39295838106c00da
humanhash: delaware-green-bravo-pip
File name:PI_CRG 9E78.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:862'208 bytes
First seen:2020-08-13 10:57:44 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:ES1zkkNtheQMw9G3ULYOYXt+XJAqbrHJn:9GQ3g2xb5DbbJ
TLSH EF0539397A815C06DA3D163044B45AD263B279873F92CF0F79CA679C6F1239B3B4724A
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.kumarilawyers.com
Sending IP: 162.144.42.75
From: Song-Ma Co., Ltd. <seantan@naver.com>
Subject: RE: CRG9E78/PI CARGO BALANCE PAYMENT AND SHIPMENT
Attachment: PI_CRG 9E78.iso (contains "PI_CRG 9E78.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.14310.997.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2f340996bc2a0e0ed96c89d3a4849439bd6b7df21df3ffe675b920c6740a983/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 10:59:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lzubgllykqob3mwzcotuscjion5nn67ehpt77thlojayz2avgbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f2f340996bc2a0e0ed96c89d3a4849439bd6b7df21df3ffe675b920c6740a983

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso f2f340996bc2a0e0ed96c89d3a4849439bd6b7df21df3ffe675b920c6740a983

(this sample)

AgentTesla

Executable exe df50adbb821e5dd2d36e35cb6d2ec32b7b523bd27803cde87c6c66350580c574

  
Dropping
MD5 b7d19f4767cc03ac9e7af9dea03c4033
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df50adbb821e5dd2d36e35cb6d2ec32b7b523bd27803cde87c6c66350580c574

Comments