MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02b60bc321254c5b19364a78498ad67b7e70a298758896d48b6e74a3de6e8c36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02b60bc321254c5b19364a78498ad67b7e70a298758896d48b6e74a3de6e8c36
SHA3-384 hash: 76d46a98c5668dd034eb17926087389f2158706508ce2ee853eb88eeab28c38e7b0741b7fdddb89d7ecdd57b666a4a6a
SHA1 hash: 43a0b875cefcd935c3129f041120bb86813a7c20
MD5 hash: abb313e10f3c55067c579a3e2a0d1d49
humanhash: kansas-kitten-minnesota-east
File name:Quote GHQ11209.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:677'926 bytes
First seen:2020-07-20 08:27:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:aS4wEIld91RwG300Nz9oYMhMhFL/89uoXOwe2E1MhKvtnuC2E5GV3JuU7wV:+fCBEQzOYMmAXOwe2dUtuC22GV3JrW
TLSH 0DE42349E52F102B92443AE8E96DDFCFD7D808CEF603A86ECC07C6E271D9D192453969
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.rajo.com.br
Sending IP: 162.241.40.68
From: AliceNg <aliceng@sz.usienet.com>
Subject: INQUIRY*URGENT FOR APPROVAL*
Attachment: Quote GHQ11209.rar (contains "Quote GHQ11209.exe")

AgentTesla SMTP exfil server:
mail.kimberleygroupbd.com:587

AgentTesla SMTP exfil email address:
reza@kimberleygroupbd.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02b60bc321254c5b19364a78498ad67b7e70a298758896d48b6e74a3de6e8c36/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:29:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ak3axqzbevgfwgjwjj4etcwwpn7hbiuyowejnvelnz2khxtorq3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02b60bc321254c5b19364a78498ad67b7e70a298758896d48b6e74a3de6e8c36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 02b60bc321254c5b19364a78498ad67b7e70a298758896d48b6e74a3de6e8c36

(this sample)

AgentTesla

Executable exe d3fa6ba60b53469cc26cf71ff0184c3c4b632337d1e59fb475d813cb1231e56d

  
Dropping
MD5 ae0b85cb4e3a1399ce36180d6775e4f6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3fa6ba60b53469cc26cf71ff0184c3c4b632337d1e59fb475d813cb1231e56d

Comments