MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b9103e741c11dc34c49170816efb8dc1792b15a199425495bd685888bc70587. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b9103e741c11dc34c49170816efb8dc1792b15a199425495bd685888bc70587
SHA3-384 hash: 02be104fc6e27f2d269f21bbdce6ea8498baa170b593c0b3252e614cd3411a5fa71f26dd836dc22be97636acb9b2ea86
SHA1 hash: 92ef77c0cb8151b803b7c82b97623b9574b49979
MD5 hash: 445ef8ab7d05c2b1413197776f7b5391
humanhash: cardinal-may-mobile-foxtrot
File name:Shipping Documents P.LIST Bill of Laden.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:437'789 bytes
First seen:2020-07-07 10:05:04 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:NAqgTki6y/g+1cotuRyxOFD6bVZqh42KaANaK2iLSOyURGhV1RMqzCnG+sCyGgHK:DgTkxy/fy6brk4JapiFEXfMqCG+sCyPq
TLSH BA9423248FC532333BD15DF8AE32D1A7C3C11A2A2A0453F0765D879EFD0A5969B84D7A
Reporter abuse_ch
Tags:AgentTesla Endurance xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: naina.m@sheramica.com
Reply-To: oscar.martinez.carnca@gmail.com
Subject: RE:SHIPPING DOCUMENTS
Attachment: Shipping Documents P.LIST Bill of Laden.xz (contains "Shipping Documents P.LIST &Bill of Laden.exe")

AgentTesla SMTP exfil server:
mail.radianthospitals.org:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b9103e741c11dc34c49170816efb8dc1792b15a199425495bd685888bc70587/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 10:07:03 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=boiqhz2byeo4gtcjc4ebn35y3qlzfmk2dgkcksk322cyrc6hawdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 0b9103e741c11dc34c49170816efb8dc1792b15a199425495bd685888bc70587

(this sample)

AgentTesla

Executable exe 135c264ce4a709eedd0f971cec5eebb546c9c31e84730793fec5552a6886f7c9

  
Dropping
MD5 71f0228d2efec9fdfa5924238877631b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 135c264ce4a709eedd0f971cec5eebb546c9c31e84730793fec5552a6886f7c9

Comments