MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fd33dc46cbf46ca72606a21635c6dbeb23adeacc304d474d4d8803e77dab7e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fd33dc46cbf46ca72606a21635c6dbeb23adeacc304d474d4d8803e77dab7e2
SHA3-384 hash: fa073863a5d6acd065e02478c0a5107908840df16163fabf2f6ab19a5b0b31546c060c2003cda781f5d21a8101e801f0
SHA1 hash: 83e35861d924f5b5feb17231b52a131f0ebc4cce
MD5 hash: 9c792e578ffcabd87a53c04618b70188
humanhash: lion-quebec-nitrogen-florida
File name:InvoiceBal.final Payment_SOA.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'415 bytes
First seen:2020-08-31 09:20:34 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:jeytuu6QDX/b+4RyB9nuA2ZxF6OblaKtEOPtWXa8:wu6QDXK4RyD8yObsKq08
TLSH 23C423948631F7B9D9472CD3C047A54DDB64621CAD77BE78A112370ECF23E9A8BB6042
Reporter abuse_ch
Tags:AgentTesla CHN geo rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: honlap.hu
Sending IP: 94.199.178.172
From: 朱君翠 <info@autofenyezeseger.hu>
Subject: 未付发票付款_Outstanding_Invoice_Payment......
Attachment: InvoiceBal.final Payment_SOA.rar (contains "Invoice(Bal.final Payment)_SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fd33dc46cbf46ca72606a21635c6dbeb23adeacc304d474d4d8803e77dab7e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 03:13:36 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7jt3rdmx5dmu4taniqwgxdnx2zdvxvmymcni5gu3cad4562w7ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0fd33dc46cbf46ca72606a21635c6dbeb23adeacc304d474d4d8803e77dab7e2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0fd33dc46cbf46ca72606a21635c6dbeb23adeacc304d474d4d8803e77dab7e2

(this sample)

AgentTesla

Executable exe e738d23963c1001eb3cc3287fd96bacb4a4f073c665c866bc3cadf39d71350e8

  
Dropping
MD5 52fdcb569f481cc22790555111d46d64
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e738d23963c1001eb3cc3287fd96bacb4a4f073c665c866bc3cadf39d71350e8

Comments