MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 082429692466215130bb037c41eeaa14dd6f40b082089a320ed6c6996ecd3e23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 082429692466215130bb037c41eeaa14dd6f40b082089a320ed6c6996ecd3e23
SHA3-384 hash: 20f8346a22da31fecba9690aa0dcd7ac6e03bf58a4e6e4a16d729f242abb4ca504add18623a5db8926a3ad318d8e474a
SHA1 hash: a70784499db35a695f7336ac181794e73d4c2adb
MD5 hash: c243afd984dc988e7d4e718d10fa4dd1
humanhash: hot-uncle-hydrogen-echo
File name:13 W04-BOD01 MOLD.l.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:222'132 bytes
First seen:2020-08-15 06:22:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:RlMEbkdTwGdb8njejdTybVCR3wuPAaXW4zX2H:RXbkdwGdb11wCRpGH
TLSH 192412DFECF0EC2D9F3023E3DAA4F5A65BB6051AA2213EA6147575245A059BFC03702D
Reporter abuse_ch
Tags:AgentTesla uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: m97143.mail.qiye.163.com
Sending IP: 220.181.97.143
From: Right Cheung <sales08@shinepackaging.com>
Subject: RE: CNC mold quote (BOD01 Mold)
Attachment: 13 W04-BOD01 MOLD.l.uue (contains "13 W04-BOD01 MOLD.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.a2e040f1b5f913c5.6534.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/082429692466215130bb037c41eeaa14dd6f40b082089a320ed6c6996ecd3e23/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 06:24:06 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bascs2jemyqvcmf3an6ed3vkctow6qfqqiejumqo23djs3wnhyrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/082429692466215130bb037c41eeaa14dd6f40b082089a320ed6c6996ecd3e23

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 082429692466215130bb037c41eeaa14dd6f40b082089a320ed6c6996ecd3e23

(this sample)

AgentTesla

Executable exe 7d2920d5d35befdc5d3e33201e437bdd9ed564762a1643e7282d96c1c2e65faf

  
Dropping
MD5 a2e040f1b5f913c50e9406a8605e65a3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d2920d5d35befdc5d3e33201e437bdd9ed564762a1643e7282d96c1c2e65faf

Comments