MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f9a417eae20cafa2d52cd56c78039fbee2fd830be8052cca12aeaa0ae0e91f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02f9a417eae20cafa2d52cd56c78039fbee2fd830be8052cca12aeaa0ae0e91f
SHA3-384 hash: a90e992a81fce21f49dd7eac82f8e14ec32500eda10836e2e3afa041a2a2a602bb2a91351973c59239414cb5c741f28e
SHA1 hash: 496300de080dd1d9bd8ca8cacb3d9050a9cc9295
MD5 hash: 2f2bfd1a63507830e38a7f6a005c35c1
humanhash: twenty-apart-uranus-saturn
File name:Scan-Copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:667'654 bytes
First seen:2020-08-12 07:29:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:TqkzYcrIdJv+9CCxujrX6Y5TQ2L44A+3s2tTanfd00xtOol7gc076lz0NQmQ:ukzYcrWJv+kCirqYj44lhtTAfzOol7gO
TLSH ECE4236B8517DA3B8DE1B9833F9D24E2C43990AF02C6A277D5C847E72E22DB57480D53
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: windy@pafindo.co.id
Received: from pafindo.co.id (unknown [45.137.22.48])
Date: 3 Aug 2020 21:30:21 -0700
Subject: RE:PO-2007-11131 LAP020271
Attachment: Scan-Copy.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.53045.21634.13865.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02f9a417eae20cafa2d52cd56c78039fbee2fd830be8052cca12aeaa0ae0e91f/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:28:33 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=al42if7k4igk7iwvftkwy6adt67of7mdbpuaklgkckxkucxa5epq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02f9a417eae20cafa2d52cd56c78039fbee2fd830be8052cca12aeaa0ae0e91f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 02f9a417eae20cafa2d52cd56c78039fbee2fd830be8052cca12aeaa0ae0e91f

(this sample)

AgentTesla

Executable exe d7739496e7b6fdc061c33aa1f9eef220166237f66259ad9ebc19b7ae2ad9a2ef

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7739496e7b6fdc061c33aa1f9eef220166237f66259ad9ebc19b7ae2ad9a2ef
  
Dropping
AgentTesla

Comments