MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02b77f0215dd4668d4d55eb9f522a765a234e05a5b3d1e1c366e3cb762ffe8a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02b77f0215dd4668d4d55eb9f522a765a234e05a5b3d1e1c366e3cb762ffe8a3
SHA3-384 hash: 27d5820f897d873a5ceb97f906dc99e10f604d8552463b6a8b22e8f7296026b57b65d93175e589f2c09fbe53424b1ea7
SHA1 hash: c74ca70bafa20dd5d20063cedfe5082817a1d759
MD5 hash: 9ff644e8567e16bb56cfb4aae63e91a3
humanhash: cup-whiskey-fix-angel
File name:Swift Payment.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:535'189 bytes
First seen:2020-11-12 07:31:13 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:OatM+6Yzg/0nFe8NAJLVpV1A0+yaQp3b4cwmZU:OaCcUcUUu3P+ya236mi
TLSH B2B4233ABD838711B166D8EA4F016DB96F0F754E5035697EC4C4E29F09C06CA0B8EA7D
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Punit Tibrewala <punit.tibrewala@talentcorner.in>" (likely spoofed)
Received: "from host.computerrentalsonline.com (host.computerrentalsonline.com [67.227.188.122]) "
Date: "Thu, 12 Nov 2020 00:36:37 -0500"
Subject: "Outstanding Invoices"
Attachment: "Swift Payment.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.bc.4827.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02b77f0215dd4668d4d55eb9f522a765a234e05a5b3d1e1c366e3cb762ffe8a3/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 04:25:05 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ak3x6aqv3vdgrvgvl247kivhmwrdjyc2lm6r4hbwny6loyx75crq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 02b77f0215dd4668d4d55eb9f522a765a234e05a5b3d1e1c366e3cb762ffe8a3

(this sample)

AgentTesla

Executable exe 686789301fea6358387eca5be159a65c666a6854e54df7b5a0f38f0e222abe88

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 686789301fea6358387eca5be159a65c666a6854e54df7b5a0f38f0e222abe88
  
Dropping
AgentTesla

Comments