MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88eb0fdc058401bdcad63056b82658838fe1374d21e7c1bbc76e5a5cad658ecd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88eb0fdc058401bdcad63056b82658838fe1374d21e7c1bbc76e5a5cad658ecd
SHA3-384 hash: 431256890e71f63f42698ef0e472a794b257adccb2529912c7d6852b6338a6499b171b8e28547a7f55c221b485f2bf8f
SHA1 hash: b7a6a5bdd44cc6a07ca9dba5a7b293d7a76b5cf4
MD5 hash: bae213e398ba5ea2d9d2c91147d17e01
humanhash: mississippi-enemy-oscar-ceiling
File name:OXITER S.L OCPC0471902020.doc.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:362'398 bytes
First seen:2020-07-24 10:51:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:HDSFYUTviIEmtQxlDSz9bwozgREAk2M7Fu/e4gf3N6t2g3w0n3rl9rIv+xVrcWDF:HDSqYjr170uf96Jn3rl92c6M9npD
TLSH FE742346CF7D4A3CC934D8DE6612D1E9C7AA1FEA515C104ACEF5EE5C000ABC2426667E
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: www.atecyr.org
Sending IP: 94.177.185.236
From: Andreu Culubret - Oxiter,sl <andreu.culubret@oxiter.com>
Subject: RV: PEDIDO DE COMPRA - PC047190/072420 - OXITER S.L
Attachment: OXITER S.L OCPC0471902020.doc.z (contains "ORDEN COMPRA 004536 LS- PC047190 OXITER SL- 07242020.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88eb0fdc058401bdcad63056b82658838fe1374d21e7c1bbc76e5a5cad658ecd/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 10:53:04 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdvq7xafqqa33swwgbllqjsyqoh6cn2neht4do6hnznfzllfr3gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/88eb0fdc058401bdcad63056b82658838fe1374d21e7c1bbc76e5a5cad658ecd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 88eb0fdc058401bdcad63056b82658838fe1374d21e7c1bbc76e5a5cad658ecd

(this sample)

AgentTesla

Executable exe baa0b105bc19ddaf3c0303f8e7dcaab546e64a4ed340fe3271d9169a2c9cee46

  
Dropping
MD5 bd8353957fdafc7976a02a29f788499e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 baa0b105bc19ddaf3c0303f8e7dcaab546e64a4ed340fe3271d9169a2c9cee46

Comments