MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b81122767d7bd31750620d08e7e59cd3302c2f557cfa0918c5d447e95ac5638. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b81122767d7bd31750620d08e7e59cd3302c2f557cfa0918c5d447e95ac5638
SHA3-384 hash: 60dbf272ac0827f9a57354c04f08cc0dbde2040f7e39b7fefe5111ea9b61e75218f020aceaf1e6414f4acfb1446ccb5d
SHA1 hash: cf2cf47279b1852affdbebb58a84d788aef8f930
MD5 hash: 8e0248e1daa16e5ad80e1bfdc070094a
humanhash: march-uniform-pip-romeo
File name:Payment Notification.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:438'272 bytes
First seen:2020-05-06 17:39:15 UTC
Last seen:2020-05-06 19:04:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:B5IF6dg3+x7c6sOBiTItBG2CTORAsKOxXPL0q8exrabL2ociN9DWIDLVEHv1XO:8F6dguxQTItBGTTOPKOlCWYLVk1
Threatray 10'671 similar samples on MalwareBazaar
TLSH 5794AE2E59BD5223E024C2F9DFD5C47BB4E4E1B731A3AE316DC297950282D02679B07E
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.kedachina.co
Sending IP: 157.245.211.27
From: Paymentsemail@fnb.co.za
Subject: Payment Notification
Attachment: Payment Notification.r10 (contains "Payment Notification.exe")

AgentTesla SMTP exfil server:
mail.mygtti.com.tw:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VTP.18028.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 18:36:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=boarej3h266tc5igedii47szzuzqfqxvk7h2bemmlvch5fnmky4a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1aa5850bed0207347b3ae757894500241e9b409004f3b762c58da5e0c4e12ad9
AgentTesla
35171408c49e8a440f8c96bf47889cc94b310a9c968e771f7d8640079fb8d798
AgentTesla
4b8d62db8bc41db322d93e617367b302796f211080ca07d138699a2923aafb23
AgentTesla
74f9b9d090503f2eb3f549a9eaf80d659e5c09d89dfcdedbb3e6f3a01421bc05
AgentTesla
9539edd2ef18098078d0835ecd1f4e5e5123eef9a3931f3e989fadafb95574eb
AgentTesla
96ff361eeb8ab440652d1cbb8b28146f8dd9ee8cf9885f84ff4592b2551da57f
AgentTesla
dfb0266da4ad6a4334216c26cab2383155a702a1b0738be8c8e2d671e1c998e7
AgentTesla
e47b659eed1b2902835b5c1d40f9c844d707fa08403e7b5f73ed88f9b9c95a6e
AgentTesla
e8ed39c9f50127f70493dedaadbd4e786c31ca7cb61f86bfc74a0d85b6a55101
AgentTesla
f94e8615fb3b739ab3ad8ec81511b5439a72d4e865a5f9975aa524ac6036d3c2
AgentTesla
+ 10'661 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-de85bn2ywa/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1f471e90b23c0c23d98735d007a4c559792324b49ad778503d7768f4a2ca12dc

AgentTesla

Executable exe 0b81122767d7bd31750620d08e7e59cd3302c2f557cfa0918c5d447e95ac5638

(this sample)

  
Dropped by
MD5 0b75e48918811cf0c04d057b34118774
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 1f471e90b23c0c23d98735d007a4c559792324b49ad778503d7768f4a2ca12dc

Comments