MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0c6d836454ed07d0c8be3fb53e85f384466f70e1acbb95b34f00c52ff896771. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0c6d836454ed07d0c8be3fb53e85f384466f70e1acbb95b34f00c52ff896771
SHA3-384 hash: 2786dee7ae5ab7dc4ff8fc4b6d1a37c81686bbae90901dda4b37f9d091147fe82ad9d5561cdd2e73b2d8ff386a1a6845
SHA1 hash: 7d8cac5b9de7781bd193d37bd2d84e083c240f42
MD5 hash: 7160f4b796f7a6ee1c2bfac58e0da40a
humanhash: hot-fifteen-uranus-wyoming
File name:Hengsu_H213800.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:24'885 bytes
First seen:2021-03-09 15:43:48 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 384:ykmbyqBdsRSw+HrdRtZ/IptOty2hM+rbXy0mdxYs4yLuvH7s/OyASFFVB6K8:vB+bgpn2hRrTRLOuP7GASHH6l
TLSH 87B2F2E9905443C6FB82101A05C1BD6A55747D6E8FD752B22366AE18B7DE04CCF7390E
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail5.maozaoo.me
Sending IP: 62.173.141.16
From: Julia <sales1@hengsugrup.com>
Subject: Hengsu order H219300
Attachment: Hengsu_H213800.z (contains "Hengsu_H213800.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 15:44:08 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ddnqnsfj3ih2del4p5vh2c7hbcgn5yodlf3swzu6agff74jm5yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d0c6d836454ed07d0c8be3fb53e85f384466f70e1acbb95b34f00c52ff896771

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z d0c6d836454ed07d0c8be3fb53e85f384466f70e1acbb95b34f00c52ff896771

(this sample)

AgentTesla

Executable exe 611a2dfac3989c66b10815fe8d6a81d92554e0ce47ec3d5b6bdd7c91c4163a7e

  
Dropping
MD5 24f160ce1d59748e942f95b3283bcfcc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 611a2dfac3989c66b10815fe8d6a81d92554e0ce47ec3d5b6bdd7c91c4163a7e

Comments