MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95a764e6b0efedc9363703f27fe032c5334f431f65dbc1d2921829b663392882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95a764e6b0efedc9363703f27fe032c5334f431f65dbc1d2921829b663392882
SHA3-384 hash: 66f31fef8627aab43c92e9b55db7e8876b1af29f8b410d20ac4ad0c02b1470a4d10ee74d66c03a3452855f82d6a498f2
SHA1 hash: 39ca25e188ba67f4831c00883212824f05183c10
MD5 hash: dab04a7c4c685a86de35102a36c3fbd7
humanhash: snake-neptune-mississippi-uncle
File name:IMG - 398745797255345363774645772-23432.LHA
Download: download sample
Signature AgentTesla
Create hunting rule
File size:24'534 bytes
First seen:2020-10-08 12:28:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:VQ/3Oo3xvq7lv3MHStnMxGCsEAHOvI3CrOKw+xAfKxqP8dcfukCDgZ2dy6rWnYrE:VG3Oo3xvq9YStnoGCsbuvwezCVPgcfaI
TLSH 76B2E09D0FB6D5D69A26097C80D602917BA1A3BDAD6F098DD4FBCFA450CCB60043D1CE
Reporter abuse_ch
Tags:AgentTesla lha


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: javainc.accesscam.org
Sending IP: 45.147.228.93
From: accounts payable <accountpayable@w0fco-ltd.com>
Subject: Re: Payment Advice Confirmation
Attachment: IMG - 398745797255345363774645772-23432.LHA (contains "IMG - 398745797255345363774645772-23432.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95a764e6b0efedc9363703f27fe032c5334f431f65dbc1d2921829b663392882/
Threat name:
ByteCode-MSIL.Trojan.GenMlwB
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 06:18:34 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=swtwjzvq57w4snrxapzh7ybsyuzu6qy7mxn4duusdau3myzzfcba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/95a764e6b0efedc9363703f27fe032c5334f431f65dbc1d2921829b663392882

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 95a764e6b0efedc9363703f27fe032c5334f431f65dbc1d2921829b663392882

(this sample)

AgentTesla

Executable exe e0d9158031423f43664f7f990234f952a95a42de4804eda933afb59053643cd3

  
Dropping
MD5 82591e9207ab805c27caa53533083504
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0d9158031423f43664f7f990234f952a95a42de4804eda933afb59053643cd3

Comments