MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c74ebb8cbeba891c2642f4580caa31edd005d91cd97097cc25279663abe869b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c74ebb8cbeba891c2642f4580caa31edd005d91cd97097cc25279663abe869b
SHA3-384 hash: e5c1f41326063a519622261e48fac2e7e2547d420091eeb17667f863c9a8d4d6917f63576c186edaf1e6a98beb57ee08
SHA1 hash: 164a2cae465695098a0df51f054db05aa054f61f
MD5 hash: a2d752635d2516c2c940f419aa63b20b
humanhash: batman-eight-emma-black
File name:INV&PL_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:462'176 bytes
First seen:2020-07-28 11:49:32 UTC
Last seen:2020-07-28 14:52:39 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:DHBJfidoL/tJmTFzu7oPwHMsq9PaTiY9kfXaBx:tJfSopJmTFooPweacaBx
TLSH ADA423CE7EA8207D24A5252AF4F2252EFBB29CE54206C7B1575D012A31336D0E4359BF
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: " seikosales@gostar.com.hk" <sulibiao025@163.com>
Received: from cloudhost-505127.us-midwest-1.nxcli.net (cloudhost-505127.us-midwest-1.nxcli.net [104.207.254.173])
Date: Tue, 28 Jul 2020 08:41:42 +0100
Subject: Re: PL & Invoices for EXW - Indaboski Bahose Shanghai shipment
Attachment: INV&PL_pdf.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c74ebb8cbeba891c2642f4580caa31edd005d91cd97097cc25279663abe869b/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 10:24:02 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fr2oxogl5oujdqtef5cybsvdd3oqaxmrzwlqs7gckj4wmov6q2nq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c74ebb8cbeba891c2642f4580caa31edd005d91cd97097cc25279663abe869b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2c74ebb8cbeba891c2642f4580caa31edd005d91cd97097cc25279663abe869b

(this sample)

AgentTesla

Executable exe 67604b91213c3d9442511b69b3281eab2554c31ed513bbf2302d61084b0693be

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67604b91213c3d9442511b69b3281eab2554c31ed513bbf2302d61084b0693be
  
Dropping
AgentTesla

Comments