MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022
SHA3-384 hash: 8ca7595b7223144f336acc43e1fef3f67904f8dc10d2f63f7907b6b6ca1cda9651ad791fbe88596ddca243d16aa66db0
SHA1 hash: 43f61d537f8afaa30b6211a4b1b423ccb8dfbc7c
MD5 hash: e0a1d9d755aed8156f9dd96e0f13599b
humanhash: mountain-uniform-angel-ack
File name:DOC070920.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:389'509 bytes
First seen:2020-09-30 06:51:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:KoVnd+WHYJb26LmB1b3JHk0+SzZshe29wgo/NAYNU9bM7kwuCoEwPUAui/g:KgdDHYc6yB1bt/zZsh19no/NAYS9bH81
TLSH 398423C67BC110C5E4AEFDB4ECDF1A855036510C647BBAB398609CE947E60D2BFA0663
Reporter cocaman
Tags:AgentTesla arj


Avatar
cocaman
Malicious email (T1566.001)
From: ""bancadistancia" <info@bbva.com>"
Received: "from postfix-inbound-3.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "Wed, 30 Sep 2020 08:50:24 +0200"
Subject: "=?utf-8?q?Notificati=C3=B3n_BBVA_net_cash?="
Attachment: "DOC070920.arj"

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.3291.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Heur.6666.5051.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-30 06:53:04 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvzvulwokaqqc3iuejxxdgo446ayg6rqpk5tlol2sb3bkm2i2ara._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022

(this sample)

AgentTesla

Executable exe d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

Comments