MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f277c56b04f5e0548d9e5f8a8ecc01d2019d75bbf51921f0e36eff478b56748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f277c56b04f5e0548d9e5f8a8ecc01d2019d75bbf51921f0e36eff478b56748
SHA3-384 hash: 1a3f73b3890fed557050117bef7492ab1bc1a29f3d74b900e5c81e1460056c83b7ed158c37c7ea442ff4735f1a4921c4
SHA1 hash: f25f870f51540f9db8c4d2f1f8944529b88dc022
MD5 hash: dcf1cf719a17f83bb0f9295ef80f12cc
humanhash: oranges-beryllium-summer-september
File name:OT 551292 GPEX- 1701115.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'473 bytes
First seen:2020-06-18 06:11:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0TwOXmfVkrPRy8lNzg4kj4pHuDc5+glWJr3BhgPE:iwOWfuJNXE4G4ADPgl6rxhgPE
TLSH 3C942345F317CF1EE72EA8FC5A981BB756818C38976DD2C0DD1F93870853892E9E8511
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Werner Götz <premer@cyber.net.pk>
Subject: PO 488.12.17 OT 551292 GPEX- 1701115
Attachment: OT 551292 GPEX- 1701115.zip (contains "OT 551292 GPEX- 1701115.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:13:05 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4txyvvqj5paksgz4x4kr3gaduqbtv23x5izehyog3x7i6fvm5ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0f277c56b04f5e0548d9e5f8a8ecc01d2019d75bbf51921f0e36eff478b56748

(this sample)

AgentTesla

Executable exe 029f7de34ffb1846f4d009c91787b37801563ca966c7604ec8194f760de6ed90

  
Dropping
MD5 c73e6c4c468828ed41e87ea762338504
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 029f7de34ffb1846f4d009c91787b37801563ca966c7604ec8194f760de6ed90

Comments