MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dfde6eb8081fd42bd8b6baaabf56f995872b6f2be0eba371817eb4754a00bca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dfde6eb8081fd42bd8b6baaabf56f995872b6f2be0eba371817eb4754a00bca
SHA3-384 hash: 6a1ad03911039f3f31b5e275460d5a41a6e2324bf196e2de4e68368481129f309a1cccb40427b061223c640afbfbc2f4
SHA1 hash: 0b81ee6db4edf4dfea7874d52b8707707fdd8ab5
MD5 hash: 2f37be581da46e3223cc276a582bb068
humanhash: fifteen-hotel-georgia-music
File name:Spare parts demand order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:539'864 bytes
First seen:2020-08-15 06:08:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:SVvq1qiuNzfNHjnNBKnmNxTVLCNq3C39FUfOR:Ki15utf9jFXTQq49kC
TLSH 71B4230CB0239674DC4A33DAA4A854BE7546DC5FB9E6EB18DF00B26EBBCF553D810588
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: properso.com
Sending IP: 62.210.157.138
From: Vitor Pereira <marketing@service.onemailmall.com>
Subject: ?????? (Spare parts demand order)
Attachment: Spare parts demand order.rar (contains "Spare parts demand order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0dfde6eb8081fd42bd8b6baaabf56f995872b6f2be0eba371817eb4754a00bca/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 06:10:10 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bx66n24aqh6ufpmlnovkx5lptfmhfnxsxyhlunyyc7vuovfabpfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0dfde6eb8081fd42bd8b6baaabf56f995872b6f2be0eba371817eb4754a00bca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0dfde6eb8081fd42bd8b6baaabf56f995872b6f2be0eba371817eb4754a00bca

(this sample)

AgentTesla

Executable exe 76c6dd89d385638ed14036393f9e31c6a92417952f95655e66beacf003c88891

  
Dropping
MD5 2fbc5c23cc080717a4bbce55ff6f3f26
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 76c6dd89d385638ed14036393f9e31c6a92417952f95655e66beacf003c88891

Comments