MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0603c029985da4fa6263f5a470b73139413ca658f171f0c55f81c9b3fc1f3e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0603c029985da4fa6263f5a470b73139413ca658f171f0c55f81c9b3fc1f3e8f
SHA3-384 hash: 6b185d1f09fb4066f148b5a90344e1aea36fd128edb17db934b304f0da8f256c6f3b45564df5fff4d29e49ab2df2384f
SHA1 hash: 8b5e685a7792015b9485b93a24835bfe545e6c64
MD5 hash: bcabc2f9affac0937c491c4896dc644c
humanhash: lemon-november-early-winner
File name:BMPI-20100077.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:493'599 bytes
First seen:2020-10-29 09:56:14 UTC
Last seen:2020-10-29 19:22:44 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:NUiAvVz9nKU2pA7F918OOid3USpUKY14t3xP6SkwM:NTAdzMdcjbJTqKo4hZa
TLSH 5CA423F09BDA936539CAE0F9FF47C23A180D45585F275A99E9BDCBD62468EC07C02321
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Johnson Varky<awtad@mideast.dualog.net>"
Received: "from mideast.dualog.net (unknown [45.137.22.131]) "
Date: "29 Oct 2020 01:59:15 -0700"
Subject: "RE:Revised PI.."
Attachment: "BMPI-20100077.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20201029-0911.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0603c029985da4fa6263f5a470b73139413ca658f171f0c55f81c9b3fc1f3e8f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 09:58:05 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ayb4akmylwspuytd6wshbnzrhfatzjsy6fy7brk7qhe3h7a7h2hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0603c029985da4fa6263f5a470b73139413ca658f171f0c55f81c9b3fc1f3e8f

(this sample)

AgentTesla

Executable exe 8272b74901554c30f76d69d2d73685da505283e0ee95fbc21cdcd0a47560d337

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8272b74901554c30f76d69d2d73685da505283e0ee95fbc21cdcd0a47560d337

Comments