MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94e40e838fec7771d393daacf71cc69b9a09b0291069cc40e8d28df8f6c9edab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94e40e838fec7771d393daacf71cc69b9a09b0291069cc40e8d28df8f6c9edab
SHA3-384 hash: dc2868d91a5da3bda9f0020e92abb796252d7f1b4fde45c86d37e06a7e35a60b9e15d82d66ebc6d5cbe295b7a5cf95ff
SHA1 hash: f774945df2c0380432d6f379394abfbb3ede49c9
MD5 hash: 54b3fc90f82fbbcefcf528e9a8c4c660
humanhash: neptune-magnesium-zulu-early
File name:Statement July 2020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'919 bytes
First seen:2020-08-18 11:56:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:mJX08ssTGVU39ZPZdDymGyyCcM+9iSvq4uwezh398pvVmLqkeMqJnpZwWay7eD:mJtsaVXUri9wezh3Op9kqbZLeD
TLSH 859423CE97C68941C9F353A1A3A576DA8D3A0826F4774E2475C91F2BC402C9EBC45FD0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: f1-logix.com
Sending IP: 103.133.106.25
From: Maya Cho - F1 Logix <mayacho@f1-logix.com>
Subject: STATEMENT JULY 2020 [F1 LOGIX]
Attachment: Statement July 2020.zip (contains "Statement July 2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94e40e838fec7771d393daacf71cc69b9a09b0291069cc40e8d28df8f6c9edab/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 02:36:51 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=stsa5a4p5r3xdu4t3kwpohggtonatmbjcbu4yqhi2kg7r5wj5wvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94e40e838fec7771d393daacf71cc69b9a09b0291069cc40e8d28df8f6c9edab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 94e40e838fec7771d393daacf71cc69b9a09b0291069cc40e8d28df8f6c9edab

(this sample)

AgentTesla

Executable exe c5df3c7e944f4f367f05546bcf2a661db13dae555a585f16b7599d35cb12213e

  
Dropping
MD5 e309883e50a4d2bb148238efa4cb455b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5df3c7e944f4f367f05546bcf2a661db13dae555a585f16b7599d35cb12213e

Comments