MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b94b7cb1cb4381987f81e62f452f29286f2ff4467c7424acdf6dcd907b8efb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b94b7cb1cb4381987f81e62f452f29286f2ff4467c7424acdf6dcd907b8efb9
SHA3-384 hash: d14b20a564eb9882c852f0e495e2847a9dbed7d3bcdc4d5288033cdcbfa2eb990b86dbb67ded2ff409361a34f6d446db
SHA1 hash: dd366296a362a87e86f27d618180dcaf1bdf0ae6
MD5 hash: 43e00f6008e69d8a0f009ef9b1df2c6e
humanhash: jig-sierra-island-sweet
File name:Inquérito 207200712.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'977 bytes
First seen:2020-08-12 15:37:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:mnl2yp9QL1+lCeqG/8a00iUu8Ep9ZBgvbN1w4xdRvLNSWbZOcA2M76b9HTKMMfs0:mB9qUYolEp0xAkpA2JJKEtrAujWYOd
TLSH FBA4238FA8567CD93F022286ADD0EDC9E7F4D0618DF1F6E8617901588DB1C9A6B871F0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se5b-lax1.servconfig.com
Sending IP: 104.244.124.88
From: sales@iranpitch.com
Subject: Inquérito 207200712 Hisense International Co., Ltd
Attachment: Inquérito 207200712.rar (contains "Inquérito 207200712.exe")

AgentTesla SMTP exfil server:
smtp.epaindemgroup.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b94b7cb1cb4381987f81e62f452f29286f2ff4467c7424acdf6dcd907b8efb9/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:39:04 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=boklpsy4wq4btb7ydzrpiuxsskdpf72em7dueswn63onsb5y564q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0b94b7cb1cb4381987f81e62f452f29286f2ff4467c7424acdf6dcd907b8efb9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0b94b7cb1cb4381987f81e62f452f29286f2ff4467c7424acdf6dcd907b8efb9

(this sample)

AgentTesla

Executable exe 9c3a4bfb0cb3da7187e39fdc53a216066058b5607bd1f1857249f7908912b48c

  
Dropping
MD5 8875e3fa12c1ea3bf5dd4c6ac049406e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c3a4bfb0cb3da7187e39fdc53a216066058b5607bd1f1857249f7908912b48c

Comments