MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85bb8c91c88a086af14dece51c981aa8ce62d030d5a66e0910c3cf33673b00c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85bb8c91c88a086af14dece51c981aa8ce62d030d5a66e0910c3cf33673b00c8
SHA3-384 hash: f808a4d3fc8d190a50b83c193de04fafdfacce1f697fcdeeb86833c3a06cb9a8d4fac4baf351ca3389a778d987df7578
SHA1 hash: cb490e1a5c25f2ea45a608f57ac1d577eda78a1b
MD5 hash: ec782e2687dfd72e809a0c9a0a907e99
humanhash: alaska-march-hamper-robin
File name:Transfer Form.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:648'211 bytes
First seen:2021-01-08 06:20:52 UTC
Last seen:2021-01-08 09:08:28 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:7X2f6kBvIc4IQO29Dta19t3natGtL0xEGnLuNBlVsn/JDvQKDMvSpaEKJ3IJMAYb:7GfhBrQOP33nOgLKLuzH+/JjFDdqgMz
TLSH 81D423B5B905918C9910F1629AB354FDA0F2F34FAF1AC760461A03EE39B0A811DFADC5
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Hernandez<acct_dept@coscosh.com>" (likely spoofed)
Received: "from coscosh.com (unknown [103.99.1.171]) "
Date: "07 Jan 2021 17:47:01 -0800"
Subject: "PAYMENT BANK INSTRUCTIONS"
Attachment: "Transfer Form.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.bc.30160.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85bb8c91c88a086af14dece51c981aa8ce62d030d5a66e0910c3cf33673b00c8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-08 06:21:04 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qw5yzeoiriegv4kn5tsrzga2vdhgfubq2wtg4ciqyphtgzz3adea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85bb8c91c88a086af14dece51c981aa8ce62d030d5a66e0910c3cf33673b00c8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 85bb8c91c88a086af14dece51c981aa8ce62d030d5a66e0910c3cf33673b00c8

(this sample)

AgentTesla

Executable exe 421993c96075e5d85af8197bb352abac1828cf974df975c4cf8cf25cc34e1722

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 421993c96075e5d85af8197bb352abac1828cf974df975c4cf8cf25cc34e1722
  
Dropping
AgentTesla

Comments