MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701
SHA3-384 hash: 6f8cc309739d40ca1dcd390dc0ad8704a7358f69f5b195e4e53e2f35d58120bd5e3ad6a6dab0a068d59c128aedc6df65
SHA1 hash: c2f4b4653b3fd4a6ae96c3cbaa4dc8fbfbbf5d1f
MD5 hash: 3332da516455861314572804ca83ebb0
humanhash: nevada-july-kitten-hawaii
File name:Invoice po.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'915 bytes
First seen:2020-07-31 10:54:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:2iW27+8M3LlJALd5Ki6Q3wq9sb/iCpPZE21zMgqW:2ij+8MxJGTKiV9W6ci2ZFqW
TLSH DEA4232D683D2F5796027B3C83121A5D9DF42C7F03B8B85BA3E44B813E3284D5A671A7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qinlian.com.cn
Sending IP: 37.49.224.45
From: 24hrwireless@bellsouth.net
Subject: FW: INVOICE
Attachment: Invoice po.zip (contains "Invoice po.exe")

AgentTesla SMTP exfil server:
mail.albaniandailynews.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24016.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 10:29:03 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sw3fvwrcjtiynpp325kc72476m4duv4u4sefzaue7wkji3fy64aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 95b65ada224cd186bdfbd7542feb9ff3383a5794e4885c8284fd94946cb8f701

(this sample)

AgentTesla

Executable exe 0f2a2c10ccdece91433063d992b2a24a316db4e1f8d2dc8f6c532fe48e0e1946

  
Dropping
MD5 336d033b63278f41d919d5e9944a9d9d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f2a2c10ccdece91433063d992b2a24a316db4e1f8d2dc8f6c532fe48e0e1946

Comments