MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3b0ee2242ceb0315fe98301b3dd516ee81fcfa9ceefb0ce57f1811f5dc602cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3b0ee2242ceb0315fe98301b3dd516ee81fcfa9ceefb0ce57f1811f5dc602cf
SHA3-384 hash: 895726c8ae6fad04f29f9c91ff6eb1482ee742a5164d8b266bcb9e0e36c059dc362c25dff0294637c7d414dc17efeaf6
SHA1 hash: d35b8799303cd84a4e0bd6ddd27bff2677197ca7
MD5 hash: a9fa8e4e751d891fb1cab05d3c8c909a
humanhash: mango-ink-solar-jupiter
File name:ARRIYADH NEW_PDF__________________________________________,,,,.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:647'168 bytes
First seen:2020-07-31 05:56:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:1b/8fwVK6wfyE0S/9U8WY5uJ/nTg/PiIlGeLazFyGgLurd:1b/8wV1vrJ/n0/aIlG6CFpgLurd
TLSH E1D4CE4E70C5445AF82939BB9FBA8083DE9AECBF8145511B37FD329307B52492991F32
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.mail.hitutorhr.com
Sending IP: 210.242.229.119
From: AL MOHAMED <bunnyedb1@hitutoracdm.com>
Subject: ARRIYADH NEW 31/07/2020 PO.
Attachment: ARRIYADH NEW_PDF__________________________________________,,,,.iso (contains "ARRIYADH NEW_PDF__________________________________________,,,,.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f3b0ee2242ceb0315fe98301b3dd516ee81fcfa9ceefb0ce57f1811f5dc602cf/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 05:58:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6oyo4iscz2ydcx7jqma3hxkrn3ub7t5jz3x3btsx6gar6xogalhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f3b0ee2242ceb0315fe98301b3dd516ee81fcfa9ceefb0ce57f1811f5dc602cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso f3b0ee2242ceb0315fe98301b3dd516ee81fcfa9ceefb0ce57f1811f5dc602cf

(this sample)

AgentTesla

Executable exe dc819faf213b4e30194d132a5d5e1393392a735ddff185f7a958cad8817e3bf0

  
Dropping
MD5 006d990068baae87993c2c091f5ea371
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc819faf213b4e30194d132a5d5e1393392a735ddff185f7a958cad8817e3bf0

Comments