MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 842ae33159c83fff85f8f6ca2e600cdfe9ffb00ce688108102adce74a72fd2d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 842ae33159c83fff85f8f6ca2e600cdfe9ffb00ce688108102adce74a72fd2d7
SHA3-384 hash: f6930abe3e67344eec00e3ea1b5c0e9596eaee3e342e485a2b26cab457ae95c84f801dfc68f209f6b93b6d7feb84dd5e
SHA1 hash: a7c9e1914dbd520331c5fa8025958c59a7e707ab
MD5 hash: 355d16965f9cc46c301d7c6af1a9f9c4
humanhash: crazy-tennis-golf-neptune
File name:4600031748.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:595'913 bytes
First seen:2021-01-12 08:37:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:beOYCYrqKAgo13rkzyJ/n65QxjutDxnunXTtZ0DAdH:bbcrwgoVrkeNtjurnyhZW2
TLSH 55C4337E6D39074B579F5FAB60DEE5349CDC2B423A204C859C0F1D8AD6086C462B6FAC
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "sales@smeguk.com" (likely spoofed)
Received: "from smeguk.com (unknown [103.99.1.171]) "
Date: "12 Jan 2021 00:14:44 -0800"
Subject: "PO_4600031748"
Attachment: "4600031748.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/842ae33159c83fff85f8f6ca2e600cdfe9ffb00ce688108102adce74a72fd2d7/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 08:38:05 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqvogmkzza777bpy63fc4yam37u77mam42ebbaicvxhhjjzp2llq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/842ae33159c83fff85f8f6ca2e600cdfe9ffb00ce688108102adce74a72fd2d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 842ae33159c83fff85f8f6ca2e600cdfe9ffb00ce688108102adce74a72fd2d7

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Dropping
AgentTesla

Comments