MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4431965a79bcc092e7cfcf60e9bf27850fc1c4a0a3cfe986746e0f8b8ecf955. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4431965a79bcc092e7cfcf60e9bf27850fc1c4a0a3cfe986746e0f8b8ecf955
SHA3-384 hash: 95006fea11b6637a750f19ec18ff1ef88728bf861571ae64508c0622c213ce78892d975df05244b768212fb21a5a8f48
SHA1 hash: 98fc0d8695f92f5c913ece8f549c4fba52ed4521
MD5 hash: 45b41850834bac0b7425335d34dd8951
humanhash: delta-five-oxygen-september
File name:FACTURA_FISCALA-RO8177382-64083983092PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'300'480 bytes
First seen:2020-08-05 11:40:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:uySEp9KgHd2gXvNcvlonO3/Vd71kzgT+LpwkpwqVy:uy98g9bfson2XegT+LpDpPy
TLSH 4455D0653980DF9DC82E0F3034232814EBF1AD121E56F64BACDA79EC17F668A4E1635D
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns5.piensanet.com
Sending IP: 91.121.181.22
From: Nicoleta Novac <Nicoleta.novac@ro.dsv.com>
Subject: DSV Solutions SRL (RO1) - Otopeni - FACTURA FISCALA - RO8177382 - 64083983092 - STAD01738202
Attachment: FACTURA_FISCALA-RO8177382-64083983092PDF.iso (contains "FACTURA_FISCALA-RO8177382-64083983092PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4431965a79bcc092e7cfcf60e9bf27850fc1c4a0a3cfe986746e0f8b8ecf955/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:15:21 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6rbrsznhtpgaslt47t3a5g7spbipyhckbi6p5gdhi3qprohm7fkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f4431965a79bcc092e7cfcf60e9bf27850fc1c4a0a3cfe986746e0f8b8ecf955

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso f4431965a79bcc092e7cfcf60e9bf27850fc1c4a0a3cfe986746e0f8b8ecf955

(this sample)

AgentTesla

Executable exe 5810c00fc828c779ee78f1e445cba199eaaadb90f6febdfc094c3f72b3ea5b8a

  
Dropping
MD5 e9fdef2aed52c5f2dee514bf597e103b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5810c00fc828c779ee78f1e445cba199eaaadb90f6febdfc094c3f72b3ea5b8a

Comments