MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f5bc629064634188024cdf8360c838fa50cce94b2320f2010e242920ef8c5a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f5bc629064634188024cdf8360c838fa50cce94b2320f2010e242920ef8c5a4
SHA3-384 hash: b8218167ceebb2299374e92ebd237573c466c9fa247ee5258358f46cbe77220be698e5a77d6c951100656d0dd27818ce
SHA1 hash: 24d8d077cca76211dd28ded701d9aeb4ccb72518
MD5 hash: 7e5f0c0dd6d7e832d96efe329285220a
humanhash: sweet-oregon-helium-quebec
File name:PO345678.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:579'984 bytes
First seen:2020-07-08 09:47:27 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:8Y1FJ1N8cY0DNkEPQXcWV9BNsEG+b+oLk0hRB/iEx:d1dYWKEP4BNsEGAh/fB/iq
TLSH 9CC433E6D8111E10F9F2EF3E01969ADD8D5A5423BEFD5B8B1ADDC2E000CA44E21685FD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: supershine.in
Sending IP: 95.211.208.25
From: Saad Issa <info1@supershine.in>
Subject: RE: NEW PO345678
Attachment: PO345678.gz (contains "PO345678.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f5bc629064634188024cdf8360c838fa50cce94b2320f2010e242920ef8c5a4/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 09:24:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5n4mkigiy2brabezx4dmdedr6sqztuuwiza6iaq4jbjedxyywsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0f5bc629064634188024cdf8360c838fa50cce94b2320f2010e242920ef8c5a4

(this sample)

AgentTesla

Executable exe 943cfd0d793dc383dfa4672bf1d2b6b67d4e4dd75b3de9fefcbbdf1f33027f8c

  
Dropping
MD5 49176bcb0b146d290d9a02e78b57d4df
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 943cfd0d793dc383dfa4672bf1d2b6b67d4e4dd75b3de9fefcbbdf1f33027f8c

Comments