MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ca75278066c75c27d1e971085281a8885dd48fd8613c622773a665e3bb3f28a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ca75278066c75c27d1e971085281a8885dd48fd8613c622773a665e3bb3f28a
SHA3-384 hash: cbf25cabdb2a3a5caff61d481a21af92be1d31cb0190adc0299e39027f8bc0bedf24793b228462d13ea54a5d32783d5c
SHA1 hash: d09b9ef7fdd4f832d9c9cbc831254661642ec82d
MD5 hash: 0207e9bb6458edde4a1d03b40d839c54
humanhash: helium-tennessee-nineteen-maryland
File name:Quotation_May_11_2020_China_delayed_payment.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'026'954 bytes
First seen:2020-05-12 11:47:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:L2p7DnOZzSs+5dmNolujjrTaMEsfJsovDuIh4ByqT:L2p2hSBvmNoyiIJZbCN
TLSH 0225337D5E12512E16423E6EB2569E0F352C6E623449C3BB5964DB4712FC3B0282FCBE
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.zsuite.io
Sending IP: 69.16.192.208
From: Sarah Mei <smtpf0x@instantofflinepresence.com>
Subject: Quotation May 12
Attachment: Quotation_May_11_2020_China_delayed_payment.7z (contains "Quotation_May_11_2020_China_delayed_payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 12:42:00 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bstve6agnr24e7i6s4iikka2rcc52sh5qyj4mitxhjtf4o5t6kfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0ca75278066c75c27d1e971085281a8885dd48fd8613c622773a665e3bb3f28a

(this sample)

AgentTesla

Executable exe 79e8240fd549793837f5eb898894d88c154bc619a3b63cc0f54a0f54f2f066c4

  
Dropping
MD5 7d2f660a659939e8d31656e380901b6c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79e8240fd549793837f5eb898894d88c154bc619a3b63cc0f54a0f54f2f066c4

Comments