MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fe6188c0e85d7efc3242d8ec918bcfac9ff01092622932c8eaf0d2157dfad6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fe6188c0e85d7efc3242d8ec918bcfac9ff01092622932c8eaf0d2157dfad6d
SHA3-384 hash: 2a0ba0993cea6a7633272a6b42f2083fbf709260b56400d7382cb88112d5ab0187cfaa86db6d42973a925324a066e637
SHA1 hash: 04c426a94a8d166ce75bc772194179e6edb366f2
MD5 hash: e63d2cfb8f032561ad8380ff3b17889d
humanhash: solar-stairway-maryland-finch
File name:Cargo documents.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'986 bytes
First seen:2020-09-30 11:34:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ROQIFOZdPNVkOB+MqYao6ot/BSjtLpovEoaOQIFOZdPNVkOB+MqYao6ot/BSjtLK:ROW4OIMizo4tpo8dOW4OIMizo4tpo8C
TLSH 7884139B0775F2A73BD392CAAE4019F0AD85782B4A44C9907B79BD4D7B103F1E9881D3
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""operations selim shipping."<operation@selimshipping.com>"
Received: "from selimshipping.com (unknown [88.218.16.126]) "
Date: "30 Sep 2020 15:00:09 +0200"
Subject: "Competitive cost proforma call for MV WINTER SUMMER | Port inquiry"
Attachment: "Cargo documents.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25511.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fe6188c0e85d7efc3242d8ec918bcfac9ff01092622932c8eaf0d2157dfad6d/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-09-30 05:52:47 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7tbrdaoqxl67qzefwhmsgf47le76aijeyrjgleov4gscv67vvwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/0fe6188c0e85d7efc3242d8ec918bcfac9ff01092622932c8eaf0d2157dfad6d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0fe6188c0e85d7efc3242d8ec918bcfac9ff01092622932c8eaf0d2157dfad6d

(this sample)

AgentTesla

Executable exe 80a52385f8f47d5ff195f29a6dc0288985d392ea4b76acc6c18320fd6ecfbf5a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80a52385f8f47d5ff195f29a6dc0288985d392ea4b76acc6c18320fd6ecfbf5a

Comments