MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98b1a19b2e6b8584b2039a66ca5c22f657b27711276c01f8dcacec3f45751972. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98b1a19b2e6b8584b2039a66ca5c22f657b27711276c01f8dcacec3f45751972
SHA3-384 hash: 039d66844b6f1a7a6e34ff565e2ece39a06d889e00e0719c44e90bc026e1f8d0bb5b4a2dfe6725aaafc286e08a70c073
SHA1 hash: d67768bdfbf6ba0ab5d02a0c92aab21bc389155a
MD5 hash: e993e53f6e05770bbc7dc6c5f2f0b771
humanhash: grey-avocado-delaware-wisconsin
File name:OCT SOA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:606'797 bytes
First seen:2020-11-10 12:40:34 UTC
Last seen:2020-11-10 13:47:33 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:cBwI+9rsHLJMtc7aQV2bI9Su85/NS2cxsmDg/fZtBYZiJBvx5:O3wsH1MtJQD9Su8dNS2cZDKmWB55
TLSH 78D423591DB21F09E0FE37819EF53CA858F94B02BDE1D5D6785CBE1CA6442F63EA0806
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sheila <sheila.you@one-line.com>" (likely spoofed)
Received: "from one-line.com (unknown [103.99.1.171]) "
Date: "10 Nov 2020 04:40:15 -0800"
Subject: "OCT SOA"
Attachment: "OCT SOA.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98b1a19b2e6b8584b2039a66ca5c22f657b27711276c01f8dcacec3f45751972/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 09:42:04 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcy2dgzonocyjmqdtjtmuxbc6zl3e5yre5wad6g4vtwd6rlvdfza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 98b1a19b2e6b8584b2039a66ca5c22f657b27711276c01f8dcacec3f45751972

(this sample)

AgentTesla

Executable exe f06c40df7dde44469aa47985010736dbd83224df91951b9d55cdb7a377353a61

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f06c40df7dde44469aa47985010736dbd83224df91951b9d55cdb7a377353a61
  
Dropping
AgentTesla

Comments