MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a6ca6bcc0fb1fd661777bffd8115e5b367f53734248333b95a9e56ad4d79bcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a6ca6bcc0fb1fd661777bffd8115e5b367f53734248333b95a9e56ad4d79bcc
SHA3-384 hash: dc03ddb44d83d4cbe2a59c7cca66ff08f51f4b610752a119fd9c3f3a2eda3ecac1ed0294f234e83e782952b936d11b3a
SHA1 hash: f466f59ae0a1ce3bb97d82cb2e0ba1255313f0ae
MD5 hash: e30789dd94bfc59e604261dba37af90d
humanhash: missouri-hot-johnny-uniform
File name:Order.new - 1.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:332'552 bytes
First seen:2020-05-05 09:15:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ZPKoOhLJabEg1Cuug3GYN7i6JL2OwtqZso5Bv499WGSKCHnw0u:QokaPWY9i6t2huhL4mLKCu
TLSH BE6423C0A687A4445CACEE6D125B2C4F35A5FB5A53CECDEF93D12D4920632C84DB83E9
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: www.mirdetstva74.ru
Sending IP: 95.183.8.87
From: Mhd. Faisal Alnus<charissa.ng@wacker.com>
Reply-To: <stoh@hansollvina.com>
Subject: RE: RE: order query ! / new order 27-08-2019 . / Order # DSPO 190828A
Attachment: Order.new - 1.zip (contains "Invoice.exe")

AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:58:25 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjwknpga7mp5mylxpp75qek6lm3h6u3tijedgo4vvhswvvgxtpga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0a6ca6bcc0fb1fd661777bffd8115e5b367f53734248333b95a9e56ad4d79bcc

(this sample)

AgentTesla

Executable exe 007a9b9e84d0340480feec469aed51d8428fda32c886068804fc6574f6d0df78

  
Dropping
MD5 0a4bc78d379bedfc32e4614ab3388a5e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 007a9b9e84d0340480feec469aed51d8428fda32c886068804fc6574f6d0df78

Comments