MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d87d3194bf255106a08251e4e94acaa63872131127f74eb77e50e474c90b616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d87d3194bf255106a08251e4e94acaa63872131127f74eb77e50e474c90b616
SHA3-384 hash: ff874f620f6d9ccc6a86bc5ad65bd5b83b1347a43aa2940eab95513ed1dc2644197e8b76b58f4f4a254757d10167c0ac
SHA1 hash: 486563df8d3e04b51df1b47b47c20fef54937d0c
MD5 hash: 688f746e1b54cfa3495b44110ff166b7
humanhash: romeo-maryland-apart-oregon
File name:doc_60987865467678.pdf.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:991'445 bytes
First seen:2021-02-11 07:57:09 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:Q8EU/oHQ/N35KNgiUE9o7zSAYAlUZespd6Y1awuUXXk7j:dZ0C35EBLEzS1AMtDmwuUX8
TLSH 872533432272CC6BBF602AB83553AF8587CA61D87C1D8F28D6A417EE89E6D1015D7F0D
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se6k-iad1.servconfig.com
Sending IP: 173.231.242.1
From: Elizse Ang <Ang-Elizse@ecosysgrp.com>
Subject: New Request PSR002165
Attachment: doc_60987865467678.pdf.r00 (contains "doc_60987865467678.pdf.exe")

AgentTesla SMTP exfil server:
mail.openaccessebooks.com:587

AgentTesla SMTP exfil email address:
psychiatry@openaccessebooks.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.9842.8589.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d87d3194bf255106a08251e4e94acaa63872131127f74eb77e50e474c90b616/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-02-12 04:16:41 UTC
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwd5ggkl6jkra2qieupe5ffmvjryoijrcj7xj23x4uheoteqwyla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d87d3194bf255106a08251e4e94acaa63872131127f74eb77e50e474c90b616

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 0d87d3194bf255106a08251e4e94acaa63872131127f74eb77e50e474c90b616

(this sample)

AgentTesla

Executable exe 7d9db239a664291a5556c35a58dfc031f424dfab9fd78f5b3f3a02851bd0702e

  
Dropping
MD5 54e691b967bb8af118342f6fd83307b7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d9db239a664291a5556c35a58dfc031f424dfab9fd78f5b3f3a02851bd0702e

Comments