MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c521b18371e5a808bdf2ad856ee7998432eda389ec8ada1f8a1a27948467711. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c521b18371e5a808bdf2ad856ee7998432eda389ec8ada1f8a1a27948467711
SHA3-384 hash: 1e49df84baa9b43be8e0b4597c42783eaf4f66a8b6897c5d72bb97d1975e9856f85016b001d193bfd550b257546c4543
SHA1 hash: de3a576df95db5147f21ac9e0addf453463006d4
MD5 hash: 54e75efb5f30f76e16fee6788038ef13
humanhash: pennsylvania-zulu-stream-vegan
File name:20200804.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:758'951 bytes
First seen:2020-08-05 06:59:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:O1WDDx72llufKkUo9JPqGCvWqi0hL/K795eJc3XY6CC28Hyqo9dx1gOuN0+fV:OcnxiufDH9RqGPqi0L/69QC4CVHyqKdi
TLSH 39F42320E3CF325A6D3F3DF77F43CA2566132FB2BCA4D72A552065D3A86540299742E2
Reporter abuse_ch
Tags:AgentTesla Maersk zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s11.thehost.com.ua
Sending IP: 176.114.0.20
From: Amit Bhardwaj / DEL IS <knin.githelpdesk@kuehne-nagel.com>
Subject: Maersk Notification_Shipment /FCL/LCL/Delivery Report, CI, PL & Draft B/L WS-FP/16-201--20/40
Attachment: 20200804.zip (contains "20200804.exe")

AgentTesla SMTP exfil server:
mail.lamitex-it.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.Bladabindi.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c521b18371e5a808bdf2ad856ee7998432eda389ec8ada1f8a1a27948467711/
Threat name:
ByteCode-MSIL.Spyware.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 05:35:51 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=brjbwgbxdznibc67flmfn3tztbbs5wryt3ek3ipyugrhsscgo4iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c521b18371e5a808bdf2ad856ee7998432eda389ec8ada1f8a1a27948467711

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0c521b18371e5a808bdf2ad856ee7998432eda389ec8ada1f8a1a27948467711

(this sample)

AgentTesla

Executable exe b347a0303ad81d21f6f73f67809d060a9c0fd0003ad63ad08e4514e221a02b27

  
Dropping
MD5 0e9504dc11a20b253ae0c9c96a839fe3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b347a0303ad81d21f6f73f67809d060a9c0fd0003ad63ad08e4514e221a02b27

Comments