MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab0c0499cd88035d08c86f41c369fd6c06cca17eecbb5fb06af842fca3f4d227. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara 3 Comments

SHA256 hash: ab0c0499cd88035d08c86f41c369fd6c06cca17eecbb5fb06af842fca3f4d227
SHA3-384 hash: ffc1e2470e73c00a70d756d106c71b81822746e1b9e623225427c66d607a07fd504b1b59dc4224042ddea8aa9b664d3e
SHA1 hash: 1a6f549a5dcee8055c8d98a6cc1268b62fd235b3
MD5 hash: aea165a927ecc1f33075759ea4e9d5c8
humanhash: carolina-stream-pasta-missouri
File name:OP#238S321Q.PDF.exe
Download: download sample
Signature AgentTesla
File size:718'848 bytes
First seen:2020-06-30 05:35:00 UTC
Last seen:2020-06-30 07:01:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 24f26e153c9b6068c0a4770547eb6d9e
ssdeep 12288:6CbpcLhilrm7G8oclWEAroCo3DQmT8FeIVUtNbTorzK5VH:9uLhi80Jro7ewwzKbH
TLSH 39E4AE22F7A0443FF072363D9D6B56BC982ABE51392C59472BE4DC4C6E397423936287
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.axnilab.com
Sending IP: 111.90.149.242
From: Joan Tam <joan@hotmail.com>
Subject: PO#QRR20/CC1604
Attachment: OP238S321Q.PDF.rar (contains "OP#238S321Q.PDF.exe")

AgentTesla SMTP exfil server:
mail.sensar-light.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 31
Origin country US US
CAPE Sandbox Detection:n/a
Link: https://www.capesandbox.com/analysis/16773/
ClamAV PUA.Win.Adware.Slugin-6803969-0
PUA.Win.Adware.Slugin-6840354-0
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/ab0c0499cd88035d08c86f41c369fd6c06cca17eecbb5fb06af842fca3f4d227/
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Lokibot
First seen:2020-06-30 05:36:06 UTC
AV detection:28 of 31 (90.32%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-r3sf6netas/
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 50.00%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ab0c0499cd88035d08c86f41c369fd6c06cca17eecbb5fb06af842fca3f4d227

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments