MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0affaf2fb7d456ec4a5b5d71284ca20a79f6441deb4f86dae15649557dd7f62f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0affaf2fb7d456ec4a5b5d71284ca20a79f6441deb4f86dae15649557dd7f62f
SHA3-384 hash: e8295aa981e5012045610a691b5305ecab8f95347c46758aecaa97c241e5e7eb8dc1a3b488cdbaecaf08a196c86346eb
SHA1 hash: af191e260af2b8ebdf8990d0648665754a74ce22
MD5 hash: fb4cd002ccf15d341fffebb0a42af274
humanhash: paris-washington-cup-table
File name:bank transfer.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:432'242 bytes
First seen:2020-08-07 13:27:53 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:eL9XXow4WSYv7wATfiLyxzLZigZ+FneNETmmJGY:k9X4w4WSYFfyQUoKlJGY
TLSH 9494235E82D6771F194082927EFFD6948A6390CCD93E87A84D337B26E0817E254EF8D1
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: abaad.om
Sending IP: 37.49.230.200
From: Syamkumar Korat <syam.kumar@abaad.om>
Subject: Bank Transfer Advice
Attachment: bank transfer.Z (contains "bank transfer.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0affaf2fb7d456ec4a5b5d71284ca20a79f6441deb4f86dae15649557dd7f62f/
Threat name:
ByteCode-MSIL.Trojan.Masson
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:29:10 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bl726l5x2rloyss3lvysqtfcbj47mra55nhynwxbkzevk7ox6yxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0affaf2fb7d456ec4a5b5d71284ca20a79f6441deb4f86dae15649557dd7f62f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 0affaf2fb7d456ec4a5b5d71284ca20a79f6441deb4f86dae15649557dd7f62f

(this sample)

AgentTesla

Executable exe a78982f275b83bfca636dca08c404c5952fbf86cba13813fb6d5e2f12ff60986

  
Dropping
MD5 f8fd00da4cff6984403946ddefebc4f2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a78982f275b83bfca636dca08c404c5952fbf86cba13813fb6d5e2f12ff60986

Comments