MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05b364e8e4fcff851eccce1cea0b1073c5b9393acca383db8c51d4077a8fba9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05b364e8e4fcff851eccce1cea0b1073c5b9393acca383db8c51d4077a8fba9e
SHA3-384 hash: ecd92fab61bc62a21d2aa958e9991938462982759b214bd6432024d96bec7ce8838b98c66a735016563f78f818262efe
SHA1 hash: 71a702d332b09f4bfe275a7514a2fe8c91047457
MD5 hash: e33dedd9e71fc8476a14137b2fe12ab1
humanhash: hamper-mango-fix-three
File name:PO564466.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:794'533 bytes
First seen:2020-11-07 06:42:18 UTC
Last seen:2020-11-07 23:06:27 UTC
File type: z
MIME type:application/x-rar
ssdeep 24576:Fqx1BEv7ogF+md8dSAEBR2hoj4OolJLWIPH4sZ:oXBCBLadoBRj4JnLrHd
TLSH C2F4234773CB37171A3E65269BAF035D42633B5ABBF7A71A8C485463103674B8B8C84E
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Ann<info@contechindia.in>" (likely spoofed)
Received: "from contechindia.in (unknown [62.113.215.229]) "
Date: "7 Nov 2020 03:40:54 +0100"
Subject: "new po"
Attachment: "PO564466.Z"

Intelligence

File Origin
# of uploads :
6
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05b364e8e4fcff851eccce1cea0b1073c5b9393acca383db8c51d4077a8fba9e/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 06:44:05 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
13 of 48 (27.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=awzwj2he7t7ykhwmzyooucyqopc3soj2zsryhw4mkhkao6upxkpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 05b364e8e4fcff851eccce1cea0b1073c5b9393acca383db8c51d4077a8fba9e

(this sample)

AgentTesla

Executable exe 2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
  
Dropping
AgentTesla

Comments