MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98d005d093d4c7d1374b62b4c17d226d1959453f8d165a513e0751250ae0da82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98d005d093d4c7d1374b62b4c17d226d1959453f8d165a513e0751250ae0da82
SHA3-384 hash: 12a4d4267dab3ebc89b7c1066b919f210d37a8527ee44bc79f16e5ae1d92013e0ec3853fd93c6f368d223b0d0ca17dcf
SHA1 hash: b33f967c5a58b8dc4525d6f40911f2ff1c5a4cd3
MD5 hash: 0e470e885114c22bef19bdd9749e1a46
humanhash: social-happy-oxygen-zulu
File name:INVOICE PDF.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:372'658 bytes
First seen:2020-07-06 08:52:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:xeF7W7cyC1EPqdXbNWOvbZuFJXylZtne5NNmFRw1rO7tft1uF+q8ZIWwOeIpYW5l:x2C7cyC1EqdyFJXy9e5NNmFRw1rO7ZPP
TLSH 6884237B29FE72998B367551E87C78A70CC55E0D1CCA45C58B9493F01E081FBAA29F42
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: chisa-novelties.com
Sending IP: 103.99.1.174
From: yummy<yummy@chisa-novelties.com>
Subject: invoice
Attachment: INVOICE PDF.zip (contains "INVOICE PDF.exe")

AgentTesla SMTP exfil server:
mail.dianaglobalmandiri.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98d005d093d4c7d1374b62b4c17d226d1959453f8d165a513e0751250ae0da82/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 08:54:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdialuet2td5cn2lmk2mc7jcnumvsrj7rulfuuj6a5iskcxa3kba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 98d005d093d4c7d1374b62b4c17d226d1959453f8d165a513e0751250ae0da82

(this sample)

AgentTesla

Executable exe ae9ea028d892118f67f92b5ff6a3a06185e0328a15f844d2209218677154876f

  
Dropping
MD5 8a4712f8fd715e41a2845a6fa53c6809
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae9ea028d892118f67f92b5ff6a3a06185e0328a15f844d2209218677154876f

Comments