MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a419b6dd8350028d142289d3e4969fab595199fb60d936900ca0a97554694c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a419b6dd8350028d142289d3e4969fab595199fb60d936900ca0a97554694c6
SHA3-384 hash: 8774a7fffce2a647561263599a5fccff6b8595d7534c1cce63496b7b21cdb92e7b99a60c468dcdf23d2100c0c67238c6
SHA1 hash: 394e627f81cb988aada3f1de79de5f3b9fb2e425
MD5 hash: b03d0c306fa96a206a2c5a523df9373a
humanhash: leopard-seven-uniform-black
File name:NEW ORDER.XZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:343'823 bytes
First seen:2020-10-05 11:53:22 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:3PmfInJExuAOnxO1gSd3WsHuUwKQQnlTStCWwBby9GxUBuWUF6:3+AJZbnSgSdGXxQnYtQBbnxH6
TLSH ED7423E153767767A411C87EC693F7659BA8DB231538B0E273C56E23EF2E143A88C091
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server1.citgroupltd.com
Sending IP: 213.246.108.82
From: shirley@createtheremarkable.com <shirley@createtheremarkable.com>
Reply-To: shirley@createtheremarkable.com
Subject: CHECK OUR NEW ORDER
Attachment: NEW ORDER.XZ (contains "NEW ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a419b6dd8350028d142289d3e4969fab595199fb60d936900ca0a97554694c6/
Threat name:
Win32.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 07:54:27 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjazw3oyguacrukcfcot4slj7k2zkgm7wygzg2iazifjovkgstda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a419b6dd8350028d142289d3e4969fab595199fb60d936900ca0a97554694c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 0a419b6dd8350028d142289d3e4969fab595199fb60d936900ca0a97554694c6

(this sample)

AgentTesla

Executable exe cd485223024b53d5b46ad361a0403b7bdcaa6d09bb43227af3a3a3dc1cfc6cff

  
Dropping
MD5 db00c5c9e7efeda5e2ee40cf8e9aabc8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd485223024b53d5b46ad361a0403b7bdcaa6d09bb43227af3a3a3dc1cfc6cff

Comments