MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a600564d101a021102f379d342261be5d059653276136f0b94b087f8bcf0cc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a600564d101a021102f379d342261be5d059653276136f0b94b087f8bcf0cc2
SHA3-384 hash: df654b9f982e1c78a9394e9650499ce82697915dce3035cc7cc847ed8f361484b6dfe900a4097dc8f3b83b0f71e99549
SHA1 hash: 5ad271d76731b362bee5b9ebe4e71468b84cb750
MD5 hash: e909241f7702c68fb622d49e7fb5520a
humanhash: harry-helium-butter-avocado
File name:Over.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:539'461 bytes
First seen:2020-07-09 14:27:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Xlw/RLFpWy5TjbrWufvdiDev4fUOdAGOSYwzrlNvZiXVXrIGgMQB:X+/RhpPbrxlg8K/APSYQZNvoqGSB
TLSH BAB4236DED05CD8202864B895C2F828DAF21BF954B96D40E2564D23DFD01D0BE6B9ECB
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: DHL Express ™ <support@dhl.com>
Reply-To: oscar.martinez.carnca@gmail.com
Subject: DHL-Overdue Outstanding On- Final Reminder
Attachment: Over.rar (contains "Over.exe")

AgentTesla SMTP exfil server:
mail.mexicanproduct.com.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a600564d101a021102f379d342261be5d059653276136f0b94b087f8bcf0cc2/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 14:29:08 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjqakzgragqccebpg6otiitbxzoqlfste5qtn4fzjmeh7c6pbtba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0a600564d101a021102f379d342261be5d059653276136f0b94b087f8bcf0cc2

(this sample)

AgentTesla

Executable exe b064d18c661ab69f54f7a4f1c1ea167553a6a324a859271a17203f2741a22c8e

  
Dropping
MD5 93da8515438ce678f4524bb46b730944
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b064d18c661ab69f54f7a4f1c1ea167553a6a324a859271a17203f2741a22c8e

Comments