MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93d3e649e0c5c1117114744ce6e097a8bce47f8a5fc257670ab0eb376e350f38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93d3e649e0c5c1117114744ce6e097a8bce47f8a5fc257670ab0eb376e350f38
SHA3-384 hash: 7a3254170165dd75cb075d6963b4f2f88d7a02192fd0830ef149254e490deb52eb23104ef10961548d433197c79cbf52
SHA1 hash: a00654a7e545194c39b7da21796adeaabf52b9d6
MD5 hash: 30b99abda2c3a134036ae30bb88b403a
humanhash: bravo-indigo-ack-artist
File name:AWB INVOICE.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'201 bytes
First seen:2020-08-14 10:57:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:s2LAmUPt3Ci/oadvdyJ7ccNEFfllqsLCnk/bnFpcQ68t1pdrm7yzzPcrezL6CVT6:s67mMi3vsITfCk/rT1rDC7yzILqXXG
TLSH 7F8423FB592DB21A08F290334FAE7C12674DCE07C2049FA7749619081EABC76D5E2ED5
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Yang Zhijian <cs_heaq@coscon.com>
Reply-To: y.ang_zhijian @coscon.com
Subject: COSCO SHIPPING LINES CO.,LTD
Attachment: AWB INVOICE.rar (contains "AWB & INVOICE.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93d3e649e0c5c1117114744ce6e097a8bce47f8a5fc257670ab0eb376e350f38/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:59:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=spj6mspayxarc4iuorgonyexvc6oi74kl7bfozykwdvto3rvb44a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/93d3e649e0c5c1117114744ce6e097a8bce47f8a5fc257670ab0eb376e350f38

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 93d3e649e0c5c1117114744ce6e097a8bce47f8a5fc257670ab0eb376e350f38

(this sample)

AgentTesla

Executable exe ddd6f260d8df7fa05eeebeedcac3c4fd519716de1659b3f7bded02aa73994f7d

  
Dropping
MD5 68842da5b46db5a2c7304800fdbf687a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ddd6f260d8df7fa05eeebeedcac3c4fd519716de1659b3f7bded02aa73994f7d

Comments