MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a24cf4a57d1f07d782ff709c60e604f95ece4422d9b78d268b753106e55632c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a24cf4a57d1f07d782ff709c60e604f95ece4422d9b78d268b753106e55632c
SHA3-384 hash: 0f239ecbf03d4b6c00e521bd620435052961b709d0c8dcd4b9ab09aea197dc38c3e33bd21c710beb9ab459393bdb0ce1
SHA1 hash: 1b052f2e4f8484c0b17e50f0a8234fd7ce5a4685
MD5 hash: 0b9d996903eeee4382089bfc979c16b6
humanhash: nuts-foxtrot-seventeen-uranus
File name:REMITTANCE ADVICE.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:788'655 bytes
First seen:2020-08-04 13:30:18 UTC
Last seen:2020-08-08 12:12:10 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:k7fyGIl1J8GM7zXTe+GlgosTGdsI2SLdBV4Tgt8al96c4HBVQ5ZS6VlSjRPGY6:yfCH8dzje3KS926BeTjc4OJLy9GY6
TLSH DEF423FB89C420DC97DDC3F590B59C918EAF9BF80663B993546267B05A08FBA08D1DC4
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hayatpharma.com
Sending IP: 103.149.13.242
From: Mohammad Hijaz <hayat.export@hayatpharma.com>
Reply-To: royalericmartin@gmail.com
Subject: REMITTANCE ADVICE
Attachment: REMITTANCE ADVICE.7z (contains "REMITTANCE ADVICE.exe")

Intelligence

File Origin
# of uploads :
74
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.Bladabindi.25609.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a24cf4a57d1f07d782ff709c60e604f95ece4422d9b78d268b753106e55632c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:32:06 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bism6ssx2hyh26bp64e4mdtaj6k6zzccfwnxrutiw5jra3svmmwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a24cf4a57d1f07d782ff709c60e604f95ece4422d9b78d268b753106e55632c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0a24cf4a57d1f07d782ff709c60e604f95ece4422d9b78d268b753106e55632c

(this sample)

AgentTesla

Executable exe 5bcb70f11599399247472b82c228cada04a5896b4fc0aa2cb8730955130a07f7

  
Dropping
MD5 a2beebb2f5840aac7bc2550ab5c5a79e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bcb70f11599399247472b82c228cada04a5896b4fc0aa2cb8730955130a07f7

Comments