MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bf0f17e87d6b71329a5632159af9d425892e527acef20aadd1ebfed11ad5ac0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bf0f17e87d6b71329a5632159af9d425892e527acef20aadd1ebfed11ad5ac0
SHA3-384 hash: 2032e7cf72d63cd00408ca0ebf36b5a71b0681d62558a2927f75b6f26a7491109b07a872edc6dd09daf111cc719655b2
SHA1 hash: b3bc0b902298fb34d855b594fb10435c6846b703
MD5 hash: 67d2e463b605d2b633add62d1edbcc95
humanhash: monkey-uniform-september-quiet
File name:New Order Comfirmation December.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:997'462 bytes
First seen:2020-12-10 19:49:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:iZKa/T6/ilVxlRW5CESyR9i/CA3w86aSdPLJ1TBWoLS:iZzTjlRRsSym/CA3w86aSdPLJ1dk
TLSH 672533025A95FC2BED4673024B2780D54FB1844F361912EF251FB5F3564A4EBAD39AC3
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "sales<sales@finishkare.com>" (likely spoofed)
Received: "from finishkare.com (unknown [45.137.22.134]) "
Date: "10 Dec 2020 09:15:41 -0800"
Subject: "Re:New Order Comfirmation December"
Attachment: "New Order Comfirmation December.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bf0f17e87d6b71329a5632159af9d425892e527acef20aadd1ebfed11ad5ac0/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpypc7uh223rgknfmmqvtl45ijmjfzjhvtxsbkw5d2762ennllaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bf0f17e87d6b71329a5632159af9d425892e527acef20aadd1ebfed11ad5ac0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1bf0f17e87d6b71329a5632159af9d425892e527acef20aadd1ebfed11ad5ac0

(this sample)

AgentTesla

Executable exe a730154eedce8c175f18e82c1102e01a7ee94fd74cbee7df85b473233ea764e6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a730154eedce8c175f18e82c1102e01a7ee94fd74cbee7df85b473233ea764e6
  
Dropping
AgentTesla

Comments