MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ede2d625006d275ff9b68417d6a4cd45d519cfe0d9a49abe5b7dfb0efef0ee7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ede2d625006d275ff9b68417d6a4cd45d519cfe0d9a49abe5b7dfb0efef0ee7
SHA3-384 hash: e2e87e86fd77aa119d7a9b7d8dcaee72134b8fbc263f77026285deb60f24dc7fd1433b9a2694b234e4b27e90c48b4576
SHA1 hash: fda2ea3facb72f6e171365069b1e892f9ee7f100
MD5 hash: dc525c5fa578467b6a97ce0a2e6524cf
humanhash: jupiter-seven-bulldog-steak
File name:Payment Details for confirmation 04.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'703'936 bytes
First seen:2022-06-06 06:43:47 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:5Icw1pNcax0F5+htb7lPwYzgmF4a1liyk5M5Aaec6UdYVmU/GZoNid79fV2CStc7:aLncax0CJria2EG+oDOwB
TLSH T1DC7582983319BDBEF857E0719A581C64BA5838BEA3CB414F601F519D991CA47CFF08B2
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:AgentTesla img payment


Avatar
cocaman
Malicious email (T1566.001)
From: "publiciteit@duo-dodo.com" (likely spoofed)
Received: "from [2.58.149.2] (unknown [2.58.149.2]) "
Date: "4 Jun 2022 10:57:56 -0700"
Subject: "Account confirmation by clange"
Attachment: "Payment Details for confirmation 04.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
334
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1121.21482.10941.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/629da2376aa17a21fc266927/reports/ab922a44-7f90-4b5d-ac9f-739b7a125ffc/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ede2d625006d275ff9b68417d6a4cd45d519cfe0d9a49abe5b7dfb0efef0ee7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-04 10:19:14 UTC
File Type:
Binary (Archive)
Extracted files:
65
AV detection:
15 of 40 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3pc2ysqa3jhl743nbax22sm2rovdhh6bwnetk7fw7p3b37pb3tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/0ede2d625006d275ff9b68417d6a4cd45d519cfe0d9a49abe5b7dfb0efef0ee7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 0ede2d625006d275ff9b68417d6a4cd45d519cfe0d9a49abe5b7dfb0efef0ee7

(this sample)

AgentTesla

Executable exe 6c5c691b8220592e29ed077baccc2b85fda2a851e96655aae685e5918becb087

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c5c691b8220592e29ed077baccc2b85fda2a851e96655aae685e5918becb087
  
Dropping
AgentTesla

Comments