MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 100b18bac5d4f85fda32bde6dd154165d29bd21230bec733719c73b4eb2b0331. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 100b18bac5d4f85fda32bde6dd154165d29bd21230bec733719c73b4eb2b0331
SHA3-384 hash: 247b355624efa68034e413e5343a34576d5e327622ac357225885efc562a5944c5061e08d0e3e24e5135054c2f03c6fc
SHA1 hash: 3c3d1fd57100c230f26903641539c7104f551556
MD5 hash: fd5382fa257e81b5c7842ae1ae081450
humanhash: avocado-hotel-whiskey-table
File name:INV TWEAR.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'238 bytes
First seen:2020-11-30 10:45:09 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:DHKt93Us7HkEndaAW41udmIwo6JSZhng4fPGxco:DHA93pV54Q/bG9fc
TLSH 5FA4239EBB4C18F30CAD6AE93730D7348D440BB67AD42DA154B5CCF1911EEE387498A9
Reporter cocaman
Tags:gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Dennis <dennis.kiptoo@programmer.net>" (likely spoofed)
Received: "from live.flashdesignengine.com (live.flashdesignengine.com [146.0.233.78]) "
Date: "Mon, 30 Nov 2020 16:02:27 +0530"
Subject: "Invoice copy of Programmer twear Ltd."
Attachment: "INV TWEAR.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/100b18bac5d4f85fda32bde6dd154165d29bd21230bec733719c73b4eb2b0331/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-30 10:46:05 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cafrrowf2t4f7wrsxxtn2fkbmxjjxuqsgc7mom3rtrz3j2zlamyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/100b18bac5d4f85fda32bde6dd154165d29bd21230bec733719c73b4eb2b0331

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 100b18bac5d4f85fda32bde6dd154165d29bd21230bec733719c73b4eb2b0331

(this sample)

AgentTesla

Executable exe ea4d7ae710b25f166a8d0a4254983d69ac60da4f6846bf912362c00f8e25c382

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea4d7ae710b25f166a8d0a4254983d69ac60da4f6846bf912362c00f8e25c382

Comments