MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ec28dd76979026f395832efad696ff0a1d44cac7b186a2448fbaee764275ae9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ec28dd76979026f395832efad696ff0a1d44cac7b186a2448fbaee764275ae9
SHA3-384 hash: 174b81b81eeff6805b712cc40336ae290085376134aca06d58daff4bea5e1a9f3aef4a158c34968001eef3b2ce9b4711
SHA1 hash: 3cd50a201d8867f721b85a1cea1b7a14d721a673
MD5 hash: 7d970f7c27e6aa27a64de763a70a6d8c
humanhash: venus-uniform-red-artist
File name:Document.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:485'272 bytes
First seen:2020-05-27 12:07:31 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:deNCh6T7MbVTTgHbm3wYqUc4bW9ZWU9074:QNDm3w/DOY0M
TLSH A7A4235F812788A0EE4905F8D5AC0C2DBDDEA520358794D7F6CAA5623BB201EC46F7C7
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bitcoin.com
Sending IP: 103.99.0.210
From: jamieredman@bitcoin.com
Subject: Bitcion Bouns Ready To Be Taken
Attachment: Document.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.8644.32604.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:33:50 UTC
File Type:
Binary (Archive)
Extracted files:
264
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0ec28dd76979026f395832efad696ff0a1d44cac7b186a2448fbaee764275ae9

(this sample)

AgentTesla

Executable exe e856965f1981e48f4f077960c75f10c352ee8bc792776e69d4f83c3f99b9ad1c

  
Dropping
MD5 de471ba7bb25bbcd916aec51e1740d1b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e856965f1981e48f4f077960c75f10c352ee8bc792776e69d4f83c3f99b9ad1c

Comments