MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30dc11373de0c74e39118a6a735c236c1ea5a983e57d1e6b8fe605347d494f26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30dc11373de0c74e39118a6a735c236c1ea5a983e57d1e6b8fe605347d494f26
SHA3-384 hash: 37b0b86e68661a570117e105c943119042e17e4ce2ec3feb62e2d4c010d563c2250a7ac7bafa8f8913862f7d8693cfe8
SHA1 hash: 2dd028303ca71a69a5bb01c4ec1b771f2fbf17e4
MD5 hash: 99cb2e5d2c627cd6f4c06b4dcf1e4247
humanhash: north-oscar-london-angel
File name:camscanner 07072020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:456'911 bytes
First seen:2020-08-17 06:07:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:qeymLGO8G23tOiCuAVHjYDI7kCKKO7BLNgKGmBKdBUyEFHTSd+4eGyAPK7ey75MP:TyW9LiiGwsgKxkKDFGd+M9PKayNJc
TLSH 3FA4232A40AFEB8A23045F0C62565721349BE56DBDBB7B2705C1DC71E323F428F6AA15
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: OMS Marine Services Pte Ltd <jjhyd@cyber.net.pk>
Subject: MEDUMH739416 and THREE WAY SHIPPING SERVICES PVT LTD
Attachment: camscanner 07072020.zip (contains "camscanner 07072020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25553.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30dc11373de0c74e39118a6a735c236c1ea5a983e57d1e6b8fe605347d494f26/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:09:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gdobcnz54ddu4oirrjvhgxbdnqpklkmd4v6r424p4ycti7kjj4ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/30dc11373de0c74e39118a6a735c236c1ea5a983e57d1e6b8fe605347d494f26

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 30dc11373de0c74e39118a6a735c236c1ea5a983e57d1e6b8fe605347d494f26

(this sample)

AgentTesla

Executable exe f5c20b9e96fde1f84b7578a3f29a00f96e161c9bbdfac2675fcd253b41627a9e

  
Dropping
MD5 42ad14940c3940a3024c6186430d8ff5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5c20b9e96fde1f84b7578a3f29a00f96e161c9bbdfac2675fcd253b41627a9e

Comments