MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a41e9020529506606dfe255d1b9ae7cd6cdf0cefceab585894baad088fba7ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a41e9020529506606dfe255d1b9ae7cd6cdf0cefceab585894baad088fba7ab
SHA3-384 hash: ebc4c338d79806741a6ecee72c41299b7d7afbb4f86752d09b2103b70c98fc3a7521da1cb514b0d25939c205b3fbb2c8
SHA1 hash: ee8e3f9ec1f0f10e0e9755b8fd23eb6bd2771286
MD5 hash: 8f986270bc07a251a155987a3a8ab685
humanhash: robert-steak-alaska-sink
File name:QUOTE 213DUB.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:883'943 bytes
First seen:2020-12-07 06:35:44 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:U67rr08JrUxXYmkL0V0jqdK5e29uq0wXzSj+RH:HkcUl5hV8qdcTXzSj+F
TLSH E415335A80D390F6ED4E374789CF0D7CAFAB61B350A759E104A89D24149FC3CABE2D16
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Stacy Tai <info@casatic.org.sv>" (likely spoofed)
Received: "from casatic.org.sv (unknown [37.49.225.12]) "
Date: "07 Dec 2020 06:51:02 +0100"
Subject: "URGENT RFQ- MTCH TAIWAN Please send quote before December 9th"
Attachment: "QUOTE 213DUB.Gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a41e9020529506606dfe255d1b9ae7cd6cdf0cefceab585894baad088fba7ab/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-07 06:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
8 of 28 (28.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bja6saqfffigmbw74jk5donoptlm34go7tvllbmjjovnbch3u6vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a41e9020529506606dfe255d1b9ae7cd6cdf0cefceab585894baad088fba7ab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0a41e9020529506606dfe255d1b9ae7cd6cdf0cefceab585894baad088fba7ab

(this sample)

AgentTesla

Executable exe 2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea
  
Dropping
AgentTesla

Comments