MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a540c0ef20f1d9fef77c0c4fd5f111a195b3707f5631eb3f5abfe731bb22f36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a540c0ef20f1d9fef77c0c4fd5f111a195b3707f5631eb3f5abfe731bb22f36
SHA3-384 hash: 19933b8aeb7a17e7bba03950728cdaefb8a0b333f9e18c9c8255b3c808d877f627bc20c70f688e873742a4af32a2c75b
SHA1 hash: 67c3e3c32b691b9b8c03348ca8caabb6c3a93813
MD5 hash: c2f24c9d1a0fada829a89f6d43b4d734
humanhash: cat-double-floor-india
File name:P.O..zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:547'625 bytes
First seen:2020-10-30 20:50:12 UTC
Last seen:2020-10-31 06:43:08 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:pUoNtrxFOCxOdFwanyebTw8NuaPkmm/P8kYvaOYLa7:pUoNkdFpTw8JPI/Pw0La7
TLSH B8C4236CE151A1D0CA26013DC5D7C550C2822B4509BCCA9CBAFD3BC397AB7A057BA67F
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.bc.1603.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a540c0ef20f1d9fef77c0c4fd5f111a195b3707f5631eb3f5abfe731bb22f36/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 21:23:01 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjkaydxsb4oz733xydcp2xyrdimvwnyh6vrr5m7vvp7hgg5sf43a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a540c0ef20f1d9fef77c0c4fd5f111a195b3707f5631eb3f5abfe731bb22f36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0a540c0ef20f1d9fef77c0c4fd5f111a195b3707f5631eb3f5abfe731bb22f36

(this sample)

AgentTesla

Executable exe 8d29d2a55106b608c38d8d444956bcb75d2257095fd74812bad445585b26bac5

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d29d2a55106b608c38d8d444956bcb75d2257095fd74812bad445585b26bac5
  
Dropping
MD5 6c4b9bbb8b3af02163931b6f5d5529ec

Comments