MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90
SHA3-384 hash: 8bffd72e790a56e0d418be3ae00eed0673a7971375bd767e78ce3911e21a5977bc1576276a8d69e8848386b8e40711fa
SHA1 hash: 2a5022062d7c6296de77254a3ffc29fb95ce64b5
MD5 hash: 13aa4cafa38d59278f59e9c4dc247bb4
humanhash: sodium-thirteen-bravo-michigan
File name:product item.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:388'375 bytes
First seen:2020-06-30 13:29:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:YrxSrnV98vSz/0vAMEOmzaq79TEVc657brYYcFTc0TeW3jsoMlhJV4UlVMY3Xtgw:YrxE99svAMEOmf7tEVDr4QO3jsllhJVR
TLSH 6F842358E7C60A93CB83EF579DFC4AEB4595983D84FE8245B19D536E28931800BC983F
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jewelryservicesetc.com
Sending IP: 172.93.148.205
From: Sales Manager<contact@jewelryservicesetc.com>
Subject: Please confirm Quote # 1-2
Attachment: product item.Z (contains "product item.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200701-0811.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 10:52:53 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bpul5g2s2423w7pzig4jjs5glk2x2ec7kku37wkujcrsmyn2loia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90

(this sample)

AgentTesla

Executable exe 482f922e584a1ef5f437364eef06912138be00e663b4198733adbda0890f454c

  
Dropping
MD5 7b59633448db19e8dce57fb2f3664b5d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 482f922e584a1ef5f437364eef06912138be00e663b4198733adbda0890f454c

Comments