MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0a95f259a92c551202eb8b0107ba812f502a500ef9fd8d5cb957e43a74627ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0a95f259a92c551202eb8b0107ba812f502a500ef9fd8d5cb957e43a74627ec
SHA3-384 hash: 85fd0317c412b82bddee795152672fa23dfc76ffb63dc006e80958e0d8b84bf4c00b972275bb4898c4baf040c8822b23
SHA1 hash: 26a700c8dfe946a16c85356d3c35401d0e106a62
MD5 hash: 76b1ae3e836a366e884a6226d4d98659
humanhash: pip-sweet-dakota-floor
File name:MT 103 HSBC banking information.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'249 bytes
First seen:2020-08-13 10:27:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:WiOVyn9Emjcuaj6RWb4cjTOtiOyjr5+dfMH0dqB:WL3qbIE2AqUd2
TLSH A294239616346A0F34D4A13F98D988AE20923CB24559A7C614EFE6FBDDDCF1FD2D0085
Reporter abuse_ch
Tags:AgentTesla HSBC r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: msc.ir
Sending IP: 185.222.58.102
From: Mohsen rezaei <mo.rezaei@msc.ir>
Subject: Lại: TẠI ngân hàng thông tin /HSBC banking information
Attachment: MT 103 HSBC banking information.r11 (contains "MT 103 HSBC banking information.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200813-0813.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0a95f259a92c551202eb8b0107ba812f502a500ef9fd8d5cb957e43a74627ec/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 07:46:51 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4cuv6jm2slcvciboxcyba65icl2qfjia56p5rvolsv7ehj2ge7wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0a95f259a92c551202eb8b0107ba812f502a500ef9fd8d5cb957e43a74627ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e0a95f259a92c551202eb8b0107ba812f502a500ef9fd8d5cb957e43a74627ec

(this sample)

AgentTesla

Executable exe 4b2ea6a05f162abced933abc57f1b74e9167bb070bd10a56a73745d908a6c57c

  
Dropping
MD5 7dd10bb400f8ea076315f7f2d0310f69
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b2ea6a05f162abced933abc57f1b74e9167bb070bd10a56a73745d908a6c57c

Comments