MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c80304eb8d23a6686db1583f8e54ef508b4b9c4b08d5b9a38e5cb21cf66d1d1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c80304eb8d23a6686db1583f8e54ef508b4b9c4b08d5b9a38e5cb21cf66d1d1f
SHA3-384 hash: 366429973821840b628629fffe3286117ab6573c858cbfd33d42342ec5692f79cb0f8a6433fc9b8039983157cd8278b7
SHA1 hash: 151c94056eea2657578693258aeb2435f420f043
MD5 hash: d07155e4b84f26447a6d993e8ea73ee9
humanhash: fillet-thirteen-spaghetti-uncle
File name:SOA for November.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'052 bytes
First seen:2020-11-12 07:35:08 UTC
Last seen:2020-11-13 00:58:18 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:G42JLUwKYHIXbdr6PZtKfyOkHVyv+8Wjq28EyMHLaJcE8mXeQ:mVHi5CKfyOkHVaN28ETLaOmXeQ
TLSH 55C4236266B5CE35A6088E57F9734AD53D220C9369F9C03DD62B5FBCBE81B58458C0C8
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Keng-Chih Wu<kengchih.wu@jci-hitachi.com>" (likely spoofed)
Received: "from jci-hitachi.com (unknown [185.222.57.73]) "
Date: "11 Nov 2020 22:31:39 -0800"
Subject: "RE: SOA NOVEMBER"
Attachment: "SOA for November.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.12197.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c80304eb8d23a6686db1583f8e54ef508b4b9c4b08d5b9a38e5cb21cf66d1d1f/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 05:30:48 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zabqj24neotgq3nrla7y4vhpkcfuxhclbdk3ti4olszbz5tndupq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c80304eb8d23a6686db1583f8e54ef508b4b9c4b08d5b9a38e5cb21cf66d1d1f

(this sample)

AgentTesla

Executable exe add9988ea6b71b207b6d20f8e8c4ddffff2097c4fd3a1db99ab89e010a7193be

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 add9988ea6b71b207b6d20f8e8c4ddffff2097c4fd3a1db99ab89e010a7193be
  
Dropping
AgentTesla

Comments