MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96bb954b905209a736d79f3fc3c58271072cb256abca935838619fd3f3d84b9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96bb954b905209a736d79f3fc3c58271072cb256abca935838619fd3f3d84b9d
SHA3-384 hash: 4b507694c39d9c7275f6e72ddad12d8a0d59f028e0be781a38ab4ccd9ea54ce4ae12da96ec147431d716eb5b1824aecd
SHA1 hash: c29e51422080f732324e4c484c012a456ec95080
MD5 hash: 465c0dd7bb5371e7051fdf4933f95b75
humanhash: november-purple-ink-uranus
File name:89488994849948.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:466'282 bytes
First seen:2020-08-20 06:18:15 UTC
Last seen:2020-08-20 09:45:55 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:2DEWfZO0RN3zlcG4EeNFR4N4DMRg4UED9:GEeZO0Rtu13cuMRgE9
TLSH EEA423029976CFC6FBB0883DFAD960CB807D93A488E6E2EB0F1A1529F05D553D133995
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ashokaelectrical.com
Sending IP: 185.222.57.205
From: offers@ashokaelectrical.com
Subject: Re:Quatation needed urgently
Attachment: 89488994849948.zip (contains "89488994849948.exe")

Intelligence

File Origin
# of uploads :
4
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200820-1606.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96bb954b905209a736d79f3fc3c58271072cb256abca935838619fd3f3d84b9d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 06:20:06 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s25zks4qkie2onwxt474hrmcoedszmswvpfjgwbymgp5h46yjooq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/96bb954b905209a736d79f3fc3c58271072cb256abca935838619fd3f3d84b9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 96bb954b905209a736d79f3fc3c58271072cb256abca935838619fd3f3d84b9d

(this sample)

AgentTesla

Executable exe 3858c456ab026309da4ac40a5dc2c8e3d360c9f27c592ffb74875443a1e775b5

  
Dropping
MD5 a880890d1ac6eb91cbade5aaf11d4c58
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3858c456ab026309da4ac40a5dc2c8e3d360c9f27c592ffb74875443a1e775b5

Comments