MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b0761a62768bae604f94d12041fa466c89cfdce9ddf0118a516df211280dc8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b0761a62768bae604f94d12041fa466c89cfdce9ddf0118a516df211280dc8e
SHA3-384 hash: 1ce8160bc953827562b8e00c9127e74fcfcb3b4d1477833189b7c3bb85285ad9760ffb48929d1c317592e9e8ce5df0f3
SHA1 hash: a93bd55417c74c1b942718b28287333bc34d23a6
MD5 hash: 5e462b4a8f660b6e88c62d9e81540829
humanhash: oscar-lithium-eighteen-mississippi
File name:Statement of account - Confirm Approval Pending.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:541'218 bytes
First seen:2020-11-12 12:37:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:7thfMVY1by7WA9EPrCM0IB7qpBf+HYHPZcnvPrNuE3I0SKnaLY:5hfMGdy7xkBX7MBf+0GvPrHnSfY
TLSH 40B423E55FB774EF8F81B6E675A2029E7F07CC50A0DC60919E49EBFD7F022A00956112
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Frannie Li <sales@itistech.com>" (likely spoofed)
Received: "from itistech.com (unknown [103.99.1.171]) "
Date: "12 Nov 2020 04:34:30 -0800"
Subject: "Statement of account - Confirm Approval Pending"
Attachment: "Statement of account - Confirm Approval Pending.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.15290.22872.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b0761a62768bae604f94d12041fa466c89cfdce9ddf0118a516df211280dc8e/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 11:20:30 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmdwdjrhnc5ombhzjujaih5em3ejz7ootxpqcgffc3psceua3sha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7b0761a62768bae604f94d12041fa466c89cfdce9ddf0118a516df211280dc8e

(this sample)

AgentTesla

Executable exe a261898485667823b47ab6885b0cd8c16d126bc0f1671dd7aeb9b675aa01aff0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a261898485667823b47ab6885b0cd8c16d126bc0f1671dd7aeb9b675aa01aff0
  
Dropping
AgentTesla

Comments