MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e7b92c84128818baa9689df4e5a5e61648eafd0fe7bed13d98684c9d27945b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e7b92c84128818baa9689df4e5a5e61648eafd0fe7bed13d98684c9d27945b6
SHA3-384 hash: 5484b869abd3b6417998e3d5f90ca62a3afd5db002e879f058d8ea8fd9dc41f9a7c5d209e1f7fb64cff51c5f3550eccd
SHA1 hash: 0cfe2bbc579d9f17e0fb8dcad34a6dd8e5bfda77
MD5 hash: 15ff616dff471a2752924c1a61533ca1
humanhash: four-failed-video-florida
File name:Invoice, Packing List BL.r15
Download: download sample
Signature AgentTesla
Create hunting rule
File size:497'951 bytes
First seen:2020-10-21 09:51:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:VHARPW3vT3xDfwSP/+4i5WDtITzrHt+KIaJQtRuAOE:VHaorhv+4i5W6PLtJJJcEAOE
TLSH 0DB423475DC1A33C2A7B6CEDD8503006DCA849B6C4884772076FC7CB6455E8EEA9E72B
Reporter abuse_ch
Tags:AgentTesla r15


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Immanuel Chow <khantransways@cyber.net.pk>
Subject: RE: Shipment Details
Attachment: Invoice, Packing List BL.r15 (contains "Invoice, Packing List & BL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e7b92c84128818baa9689df4e5a5e61648eafd0fe7bed13d98684c9d27945b6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 03:25:39 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bz5zfscbfcayxkuwrhpu4ws6mfsi5l6q7z562e6zq2cmtutziw3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0e7b92c84128818baa9689df4e5a5e61648eafd0fe7bed13d98684c9d27945b6

(this sample)

AgentTesla

Executable exe 20c0aebe7cad9faafeff8655a50fb31ef9e91208f17035f3b90b91ab8fce0e86

  
Dropping
MD5 c85ee54b21bc5a74b19ebeed1d300392
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20c0aebe7cad9faafeff8655a50fb31ef9e91208f17035f3b90b91ab8fce0e86

Comments