MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3
SHA3-384 hash: 81593b00ebeea9acd0aab0b259a108dcb5117e63557c22e0bac31cce484f7f3a206f14cefc18f2b7b1b8241548b81075
SHA1 hash: d9e57ff32fe826ed35368dfb0e5b4bb47fd7f811
MD5 hash: 113190230355ecebef6b5cf1a0106293
humanhash: delta-item-blossom-spring
File name:URGENT ORDER 03082020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'036 bytes
First seen:2020-08-04 07:02:42 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:MWqKRiA9NrU/yrNNz/G2MVWnLmQN9g7otX00XZEOvu/z9pnUui1hxQER1D:Lq2a/AvCHgnL9Pg7otXkHb9lUui7xDD
TLSH 938423ED51BF138A2F1CB2A76F676FDCBA2854F09463127F7EA60351EA100640482ED3
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.outgoing.loopia.se
Sending IP: 93.188.3.38
From: Ċ½elvoz Smederevo <nabavka@zelvoz.rs>
Subject: *TOP URGENT* NEW ORDER
Attachment: URGENT ORDER 03082020.gz (contains "URGENT ORDER 03082020.exe")

AgentTesla SMTP exfil server:
smtp.wtgriderline.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:04:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bo3igtdkr3cgb7jga26lggcf47mot7ealzew2if227r6zzb3xtjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3

(this sample)

AgentTesla

Executable exe b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086

  
Dropping
MD5 5a660770d48cf223a26ddfc3efc7155c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086

Comments