MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b6652d43ca552e9e851fed9327cf429286cd9b58464c66d316591d38013e068. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b6652d43ca552e9e851fed9327cf429286cd9b58464c66d316591d38013e068
SHA3-384 hash: f82c63e962992b8ebd22e4035e0e87849e03e857badd62de50fa7c755bb1f615889720127d2ebfe617cc1fb0dcd73a87
SHA1 hash: d4d10e57773fe37d5aeb970a79587f90cf60e198
MD5 hash: dd8304a4167a6a75d93f107d6c403d7f
humanhash: sixteen-august-india-august
File name:NEW ORDER584532-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:525'035 bytes
First seen:2020-08-31 14:08:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0O48oJIkaUzv+MWWchWiyVh4uQRRaLYApg/XhhQG:0kQIL0v+lWcEikSRiC/x+G
TLSH 0FB42336E9026D50B8BFE34EB4680D3D3AD2E71E42A74F439CB9BB4950E54C1294B94F
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail2.gymsnv.sk
Sending IP: 193.87.164.19
From: Gillian Martin <Gillian.Martin@spaceandpeople.co.uk>
Subject: REQUEST FOR QUOTATION (RFQ) 3RD REMINDER
Attachment: NEW ORDER584532-pdf.7z (contains "NEW ORDER#584532-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b6652d43ca552e9e851fed9327cf429286cd9b58464c66d316591d38013e068/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 06:58:36 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bntffvb4uvjot2cr73mte7hufeugzwnvqrsmm3jrmwi5haat4bua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b6652d43ca552e9e851fed9327cf429286cd9b58464c66d316591d38013e068

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0b6652d43ca552e9e851fed9327cf429286cd9b58464c66d316591d38013e068

(this sample)

AgentTesla

Executable exe abce854dbb1be834088423c8a911d7111cd6d205b9f6b44be000652860fa03c6

  
Dropping
MD5 307902f464ab56b98f667520dcd68295
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 abce854dbb1be834088423c8a911d7111cd6d205b9f6b44be000652860fa03c6

Comments