MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0fa933bbc3012a9dda4ec4103e442d1fb67dcb7c862f307604ec1e42a559ee8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0fa933bbc3012a9dda4ec4103e442d1fb67dcb7c862f307604ec1e42a559ee8
SHA3-384 hash: 340ba9026aa4998ab1fcf2fb27b40e62ad1f430669004c9b1682dd7ff10d697fc8b6c8b8f169cba78c2499d2b009f339
SHA1 hash: e0c1fa423c63a954ee09f8a16a8d55337d1c4c6e
MD5 hash: dff68de958abfd7cec0c1a11d5bdbd80
humanhash: quebec-nuts-oven-alanine
File name:PO C6469900H.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'204 bytes
First seen:2020-05-13 06:40:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:68DFMr+WN+Vf3lUwqgYfHG21Q979HpFJoCJ7L/fghRWpHvRji0xdSIaWhsx83tKk:JDCr7wUKYf09hV7L/ohRWpHvDoWxUN5o
TLSH 688423DE5A3EA44EF34650CE46EB9C512AAD89A8355F3DB9C8C03F3763013B19448ADD
Reporter abuse_ch
Tags:AgentTesla nVpn zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: yisun.co
Sending IP: 111.90.159.196
From: Edward Billingsley <e.billingsley@dencomedical.com>
Subject: RE:official PO
Attachment: PO C6469900H.zip (contains "PO C6469900H.exe")

AgentTesla C2:
http://79.134.225.114:34/qu/inc/f3da59b5b9f746.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 04:36:39 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2d5jgo54gajktxne5raqhzcc2h5wpxfxzbrpgb3aj3a6iksvt3ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d0fa933bbc3012a9dda4ec4103e442d1fb67dcb7c862f307604ec1e42a559ee8

(this sample)

AgentTesla

Executable exe e70a32319ddb990bd412b11fc12e09e00105104fbd576e5e0f9c40445f910ae4

  
Dropping
MD5 69a0a39d6fd7052f2ecdc08aff4c0780
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e70a32319ddb990bd412b11fc12e09e00105104fbd576e5e0f9c40445f910ae4

Comments