MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4b4cedca105f41ffe38fafe7e8eeeda3d30f837a96940ae3db574875e2fab89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4b4cedca105f41ffe38fafe7e8eeeda3d30f837a96940ae3db574875e2fab89
SHA3-384 hash: e28f4639fd0fed154c9b7df5ef0f2d59b93d269f05f070eff8bae00a62ffe0a21aafeddd5e1a357752bb4aeeaab7ab4c
SHA1 hash: 749ef1d6ac77885445ecdd2039c7bd874e85eaa4
MD5 hash: 215f7e8c62558bc2813183b5e9b00e01
humanhash: eleven-apart-vermont-cola
File name:Mutiara PO- 20000883 Mirrorkote WT back print.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:782'900 bytes
First seen:2020-07-20 14:29:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gYrCRDvZfsdSvv/sFruyt/zazS6veWk4g827ngHirs7D80PIaiQNSvt9zbj3GYrx:ZsDBf13YDuPG3E2LgCgsG29Pj3GkSHjO
TLSH 87F4334597928348DAD3E0543FC2498B96D26468E773F7B04CE2EBF812D8BC15761ACC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.cinderllafashion.com
Sending IP: 45.95.169.119
From: 銅鑼生產計畫課-吳彥瑤 Nina <nina@pahsco.com.tw>
Subject: Mutiara PO- 20000883 ( Mirrorkote W/T back print).
Attachment: Mutiara PO- 20000883 Mirrorkote WT back print.zip (contains "9P4eCvIi4o7THCV.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EONH.23249.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4b4cedca105f41ffe38fafe7e8eeeda3d30f837a96940ae3db574875e2fab89/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 14:30:09 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2s2m5xfbax2b77ry7l7h5dxo3i6tb6bxvfuublr5wv2ioxrpvoeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4b4cedca105f41ffe38fafe7e8eeeda3d30f837a96940ae3db574875e2fab89

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d4b4cedca105f41ffe38fafe7e8eeeda3d30f837a96940ae3db574875e2fab89

(this sample)

AgentTesla

Executable exe f2d446378bebc1c5cb4fdd8941445bc9de335315ea90115c1db4a141155decb4

  
Dropping
MD5 1b94437575fd228b3889241bf4b113ef
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f2d446378bebc1c5cb4fdd8941445bc9de335315ea90115c1db4a141155decb4

Comments