MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ab94bcd0c12334a883fda968d9ea6fd5b5085005d36a0654ed0f59c25a48cab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ab94bcd0c12334a883fda968d9ea6fd5b5085005d36a0654ed0f59c25a48cab
SHA3-384 hash: b0f86674e934af8f6e2f0b0de187d10283b51ea8e930b68053efbc179394e8e1c55f228d117a9461da33ca2ae90ca313
SHA1 hash: 10cf344e73fcc48810489decd4ac22502246c5c6
MD5 hash: c0b6fa9cd9146667997a40d824777d4d
humanhash: gee-princess-cardinal-fruit
File name:POM01052020.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:389'475 bytes
First seen:2020-05-04 20:25:21 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:lxXSgZ1GwLvIE7W5LfUX8EPQlTy328kng7XOKUiX73IM4ZYMHUEM4edUzvQzCv2c:H1RLv9WhnEYlTM25qeKUiX74M4aMHUXc
TLSH E48423CF592EEAA6C5812ED7ACD05247443F5E26F444E13F82DE14ECDA4A5B1200B9F3
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pldtdsl.net
Sending IP: 45.137.22.58
From: Daisy Ruth Pacheco<tradepts@pldtdsl.net>
Subject: Our PO No. M01052020
Attachment: POM01052020.GZ (contains "POM01052020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 20:35:52 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bk4uxtimcizuvcb73kli3hvg7vnvbbialu3kazko2d2zyjnersvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0ab94bcd0c12334a883fda968d9ea6fd5b5085005d36a0654ed0f59c25a48cab

(this sample)

AgentTesla

Executable exe 0598b4ce2460676755245bad49490a9c94ae85a074c2242adfa65c52b0ad3796

  
Dropping
MD5 f4455f4b22f4dbd1ea488cd8afca5047
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0598b4ce2460676755245bad49490a9c94ae85a074c2242adfa65c52b0ad3796

Comments