MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea
SHA3-384 hash: 07c639d93ea8631192449d29ffa665cc593b3a8ea5b6d0458e630f8844d589b86e42b92fef369980f65ba17ce6a49bc5
SHA1 hash: 98f71b22d43a2fb8b04c480c8b69754e20625c1a
MD5 hash: 49348f071922b7100f4b43bc7e817059
humanhash: william-single-lima-one
File name:RFQ 2020.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'775 bytes
First seen:2020-05-22 07:11:45 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:jVdM9izSyxH58FwNf4rcGL1vjlqSCWhTwL3R3pTBVivktH1pMH4yo:ZOipxHuFUWpv4SCWhT+RXL
TLSH 018423D74D6818A9BAD8FCEE5FD4B263425D786DD3ED10B662A9333653E841C2102E8C
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ombudsman.uz
Sending IP: 198.23.210.131
From: Nurul NG <info@ombudsman.uz>
Subject: URGENT RFQ- GACA 2020 PROJECT REF: 2211342
Attachment: RFQ 2020.7z (contains "myHCMK7ruWH4kYF.exe")

AgentTesla SMTP exfil server:
smtp.lettu.us:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:31:36 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea

(this sample)

AgentTesla

Executable exe 32a725941812a7722531f5575dd8f25d60392878b1d1d17c48797ac197981fd3

  
Dropping
MD5 c3561e6ae15aa8f0b68309d6f20798a9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32a725941812a7722531f5575dd8f25d60392878b1d1d17c48797ac197981fd3

Comments