MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701
SHA3-384 hash: 6f8cc309739d40ca1dcd390dc0ad8704a7358f69f5b195e4e53e2f35d58120bd5e3ad6a6dab0a068d59c128aedc6df65
SHA1 hash: c2f4b4653b3fd4a6ae96c3cbaa4dc8fbfbbf5d1f
MD5 hash: 3332da516455861314572804ca83ebb0
humanhash: nevada-july-kitten-hawaii
File name:Invoice po.zip
Download: download sample
Signature AgentTesla
File size:460'915 bytes
First seen:2020-07-31 10:54:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:2iW27+8M3LlJALd5Ki6Q3wq9sb/iCpPZE21zMgqW:2ij+8MxJGTKiV9W6ci2ZFqW
TLSH DEA4232D683D2F5796027B3C83121A5D9DF42C7F03B8B85BA3E44B813E3284D5A671A7
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: qinlian.com.cn
Sending IP: 37.49.224.45
From: 24hrwireless@bellsouth.net
Subject: FW: INVOICE
Attachment: Invoice po.zip (contains "Invoice po.exe")

AgentTesla SMTP exfil server:
mail.albaniandailynews.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
30
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
High
Geo location:
NL Netherlands
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 10:29:03 UTC
AV detection:
26 of 48 (54.17%)
Threat level
  5/5
Threat name:
Suspicious File
Score:
0.45

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments