MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f
SHA3-384 hash:	3c911bf384ff5b60a877fd1ca6660a2dc0eb278366e398a0c9c42bd77ee71b8df3d9c9ea2e4de974de166ae847adc1b3
SHA1 hash:	f23f8a1a6d7510a94693caa71e6d2503fd29f905
MD5 hash:	f0fdab579e9ff3b074ac2432baade6c0
humanhash:	fix-victor-missouri-lemon
File name:	EFT_Deposit_9857849statement.img
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	757'760 bytes
First seen:	2023-03-10 06:53:33 UTC
Last seen:	2023-03-10 07:08:14 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	12288:+m96yklSiyLiijbcbG6gj0mj95KuEY7SGKkID5lEbgrzx:xidiMbG6gj0mj95KuEYeGKkID5lEbgr1
TLSH	T1FCF46B5D67EC6A1EF5BF0B32C0F115178BA4E852EB5FE74E148089A98D297C68C31783
TrID	99.4% (.NULL) null bytes (2048000/1) 0.2% (.ISO) ISO 9660 CD image (5100/59/2) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter	cocaman
Tags:	AgentTesla img

cocaman

Malicious email (T1566.001)
From: ""Account Receivable | karschcapital.com" <bhirsh@karschcapital.com>" (likely spoofed)
Received: "from mail.zimbra.imakesolutions.net (mail.zimbra.imakesolutions.net [62.212.75.52]) "
Date: "Thu, 9 Mar 2023 16:55:28 +0000"
Subject: "EFT Direct Deposit received on March 09,2023"
Attachment: "EFT_Deposit_9857849statement.img"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	EFT_Deposit_9857849statement.exe
File size:	706'048 bytes
SHA256 hash:	f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
MD5 hash:	9b66e8c887f0dd97d7e4dba459a81e8f
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1869.21889.3494.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso obfuscated

Link:

https://www.filescan.io/uploads/640ad40e3774707c2639bcf5/reports/544c0d90-0927-4cc9-8f22-369d164a95fa/overview

Verdict:

Suspicious

Labled as:

Mal/DrodIso

Link:

https://www.hybrid-analysis.com/sample/fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-03-09 16:47:56 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

8 of 37 (21.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7pdfbiqrgsacevmjkp66z5yorlpy3rvyhhpaerzoqviit2mqkmxq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research