MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 166b0efb4c6a6a01be011ddda6afeeb4cc431150c62bc091aea8a7d7fa29d0a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 166b0efb4c6a6a01be011ddda6afeeb4cc431150c62bc091aea8a7d7fa29d0a5
SHA3-384 hash: e4a76531cd81a8043e094a875cb2f4cc435757401bf33ac8cf2b43533be1c8ece4e5dd155022d24908359cddebfafb27
SHA1 hash: 5d327ab5163eb2b6454202c9996d4397ce4b9cdb
MD5 hash: c1acd527d5074f6e137ab602ff86d41b
humanhash: sierra-connecticut-king-spaghetti
File name:IMG-3798778934432345987789987890-87674.lha
Download: download sample
Signature AgentTesla
Create hunting rule
File size:331'308 bytes
First seen:2020-08-13 06:56:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:mZCA5knTS7O1kOnymrC9T14k/GCTOXg+3cC9rqFsJWjwxJaI3DQQYz:mv6nTWOKO1k5kCTCckrf+i73DY
TLSH B464230CF9A5F1833DA273B9EDB722B1258D5B5A5731D00FF5C9320AAA6C3BC0174A64
Reporter abuse_ch
Tags:AgentTesla lha


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.minuskel.de
Sending IP: 193.96.188.111
From: accounts <accountpayable@afslogistics.com>
Subject: Re: Payment Advice Confirmation
Attachment: IMG-3798778934432345987789987890-87674.lha (contains "IMG-3798778934432345987789987890-87674.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23535.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/166b0efb4c6a6a01be011ddda6afeeb4cc431150c62bc091aea8a7d7fa29d0a5/
Threat name:
Win32.Spyware.Datacollectora
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 06:58:06 UTC
AV detection:
31 of 47 (65.96%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=czvq562mnjvadpqbdxo2nl7owtgegekqyyv4benovct5p6rj2csq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/166b0efb4c6a6a01be011ddda6afeeb4cc431150c62bc091aea8a7d7fa29d0a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 166b0efb4c6a6a01be011ddda6afeeb4cc431150c62bc091aea8a7d7fa29d0a5

(this sample)

AgentTesla

Executable exe 91c8f2961875cc9e46f40ea917b6d83c45301926d88bb8a0af857f3caedcf8bc

  
Dropping
MD5 9be02f612594c0a6d3e968a08d6f0c1e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91c8f2961875cc9e46f40ea917b6d83c45301926d88bb8a0af857f3caedcf8bc

Comments