MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bd578687cf1c9ebb4acbc9fc7a7fd8999ae791d5f7848a623bfc09a2445f2a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bd578687cf1c9ebb4acbc9fc7a7fd8999ae791d5f7848a623bfc09a2445f2a0
SHA3-384 hash: 998d3e94788df173e8ee36d86ecf57a28ff29af8defc81fc018e1ca8a7d4b247f1a74dd75c35ea75227e3bf156cb8924
SHA1 hash: aaf7cc755a10e3305eb1bfbec66f3c63308bc413
MD5 hash: fdab99f162213b5fb2468be71ab8e605
humanhash: idaho-dakota-nevada-william
File name:JQ2341024749.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'945 bytes
First seen:2020-07-16 18:38:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:nNb2dkxeDvN+UFH3IDT3UcZr+t+Y2BGcSLJttbSeCha2u9wDfXBGI1RY8P0:F8oep+fctfhXF7vwMAYe0
TLSH 868423D56BDE160BB1AB9377B77A28C76544AE2D9B332084DC10C8D8535BA5333FAE01
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: souriau.com
Sending IP: 37.48.85.232
From: Haiyan Zhao <sales@souriau.com>
Subject: RE: [Quote JQ2341024749]RE: new RFQ
Attachment: JQ2341024749.pdf.zip (contains "JQ2341024749.pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bd578687cf1c9ebb4acbc9fc7a7fd8999ae791d5f7848a623bfc09a2445f2a0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 15:08:28 UTC
AV detection:
28 of 47 (59.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bpkxq2d46he6xnfmxsp4pj75rgm246i5l54erjrdx7ajujcf6kqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0bd578687cf1c9ebb4acbc9fc7a7fd8999ae791d5f7848a623bfc09a2445f2a0

(this sample)

AgentTesla

Executable exe 6c10ad5e7c9768684b4c869b3d6d974e07245af487170866b38bb2a5f4a756c6

  
Dropping
MD5 32e8a4dfef3ba9272759b8cc19e0428b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c10ad5e7c9768684b4c869b3d6d974e07245af487170866b38bb2a5f4a756c6

Comments