MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89fde97cbb55793882ef7b014f263e8ffd62939bb82ab762dec7a7cc8d683746. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89fde97cbb55793882ef7b014f263e8ffd62939bb82ab762dec7a7cc8d683746
SHA3-384 hash: a7549f9b74ece3347054821b24ddd3c2032273ab7950505d5b4a7b841323d20b2bb4344c4dc10ac7eda90f82c43cf7e3
SHA1 hash: 5240034ba2359dcb5b2439953433bc6ec4a314e2
MD5 hash: 3e4051c144ae44fe06eb45d5254902b0
humanhash: foxtrot-south-spaghetti-undress
File name:REMITANCE COPY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:698'869 bytes
First seen:2021-02-08 05:40:55 UTC
Last seen:2021-02-08 11:19:18 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:pvqIvd0PNM4wUsGHIs5Z0RseC3lVxXskDgQRCAJuCEsMSIXV0OlQoGpz8O4H9T:R+N+UsBs5Zi+Xsk2CEPSsqc9T
TLSH 35E4230CAF6E821DDD55296827FF5E5714F2FB69CE703F2958BE6C23A75B0098061A30
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "UniCredit Bank <Munari@unicreditgroup.eu>" (likely spoofed)
Received: "from air.nseasy.com (air.nseasy.com [64.37.52.73]) "
Date: "Sun, 07 Feb 2021 20:40:22 -0500"
Subject: "Payment Swift Copy Notification From UniCredit Bank S.p.A"
Attachment: "REMITANCE COPY.zip"

Intelligence

File Origin
# of uploads :
4
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis09155DE037C9.21198.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89fde97cbb55793882ef7b014f263e8ffd62939bb82ab762dec7a7cc8d683746/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 05:41:05 UTC
File Type:
Binary (Archive)
Extracted files:
88
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rh66s7f3kv4traxppmau6jr6r76wfe43xavloyw6y6t4zdlig5da._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89fde97cbb55793882ef7b014f263e8ffd62939bb82ab762dec7a7cc8d683746

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 89fde97cbb55793882ef7b014f263e8ffd62939bb82ab762dec7a7cc8d683746

(this sample)

AgentTesla

Executable exe f0998181a413c33d7696007625fdaa39855e454ef248ca2f2368ff2618468271

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0998181a413c33d7696007625fdaa39855e454ef248ca2f2368ff2618468271
  
Dropping
AgentTesla

Comments