MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa8e63e9dee8bdb835c0fe12f4b6da02840f3a4dc068826eb3a29db4c1201d3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa8e63e9dee8bdb835c0fe12f4b6da02840f3a4dc068826eb3a29db4c1201d3c
SHA3-384 hash: 5b220e868c4c6be1f148018c51a006890a38aed420307ae0b6483df8b13ca573fba885555fade87e784a062dea6d4b7f
SHA1 hash: e58a21cbf7dcefed3b42acfedaf0690f57132b4b
MD5 hash: ac9f6d2134beaa0fce196ebc5bcff35b
humanhash: sodium-march-red-wisconsin
File name:CMZ TD-36-Y-1351 Quotation No 30604140520.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:585'728 bytes
First seen:2020-05-14 07:31:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:tO4MlpiO9vgZLIbOfBEBAyo+/P4rGmPJZLl0xjLssO6:tOxxFbOfKBAyoogHblisT6
TLSH B2C4CF1436BD1375E4B68BF569A19054CBB1722A74BCD32D9CC864CE2BE2F80DA05E37
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: allalloy.com
Sending IP: 203.175.162.81
From: alessandro Fearless <alessandro.sanzapaura@cmz.com>
Subject: Offerte TD-36-Y-1351
Attachment: CMZ TD-36-Y-1351 Quotation No 30604140520.iso (contains "CMZ TD-36-Y-1351 Quotation No 30604140520.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EKOX.22483.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:37:09 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7khgh2o65c63qnoa7yjpjnw2akca6osnybuie3vtuko3jqjadu6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso fa8e63e9dee8bdb835c0fe12f4b6da02840f3a4dc068826eb3a29db4c1201d3c

(this sample)

AgentTesla

Executable exe f027e23fafcf6d6cc98e9a02fdd2be9c4ca65d9343656f3839e94dc153de160e

  
Dropping
MD5 ab80cd921cad48ea0c5c7ff4d0771d57
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f027e23fafcf6d6cc98e9a02fdd2be9c4ca65d9343656f3839e94dc153de160e

Comments