MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba866abc7606aa0ca02f0478443a732847b596f55e51bebe9e2c9d4e79e752f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba866abc7606aa0ca02f0478443a732847b596f55e51bebe9e2c9d4e79e752f8
SHA3-384 hash: 7440a5f00f3aff785ba67d5a8fe3bebbed93274cf258d394a6794ab7487629a6b35913016c65036d606a88852d3aa410
SHA1 hash: 0472ef5a92b5ab25144c437d35630d1b415b013a
MD5 hash: e0a801be7fd11b4cba8173b123a4ea54
humanhash: eighteen-summer-north-golf
File name:W04-BOD01.A.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:356'720 bytes
First seen:2020-08-18 09:52:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ADdsETuBKi9UW851V84sYFn9A8MYVQfOrzf646cB7IeA7fDOB+vgl+dfo+e61va:AxsETRZW856yn9A8jE+zf2a7NA7fC+tg
TLSH 5B74237EA9B33467A6D7DB0191CFFA5CC419CE13C73B419EA64A83B93B2CE041696350
Reporter abuse_ch
Tags:AgentTesla MailChannels uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bat.birch.relay.mailchannels.net
Sending IP: 23.83.209.13
From: sales@co.jp.nixcli.xyz
Subject: RE: PO W04-BOD01
Attachment: W04-BOD01.A.uue (contains "W04-BOD01.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba866abc7606aa0ca02f0478443a732847b596f55e51bebe9e2c9d4e79e752f8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 09:54:06 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkdgvpdwa2vazibpar4eiottfbd3lfxvlzi35pu6fsou46phkl4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ba866abc7606aa0ca02f0478443a732847b596f55e51bebe9e2c9d4e79e752f8

(this sample)

AgentTesla

Executable exe 11a5f4461ccbc87643e0bf662301104bd17ae6720869ed6edd5cfa5538c26740

  
Dropping
MD5 98c0e2f1cca9f1cf1e2303346fbb1509
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 11a5f4461ccbc87643e0bf662301104bd17ae6720869ed6edd5cfa5538c26740

Comments