MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a269b4e2c5d92be7010b9365c063d9a04df9c21227e0b90fa29e3f98dbcbc28f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a269b4e2c5d92be7010b9365c063d9a04df9c21227e0b90fa29e3f98dbcbc28f
SHA3-384 hash: 4dca6bda6729576ccad5432be8b51437ba07f25c775f98df4ad93346202a6a916cd6b1dbbcbba77a97ab6605b9f65eaf
SHA1 hash: f531f269f065273119edeb53b69c96bb80cc426b
MD5 hash: dc5eba68c799a6d621e008a34342d167
humanhash: fourteen-chicken-beryllium-single
File name:SOA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:484'725 bytes
First seen:2021-01-06 16:05:17 UTC
Last seen:2021-01-06 20:13:27 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:KXL3/5u+x83I/w51SJV+pljvKgV8RAxYyjbQXwXmrjZd3qxqL+:Kg+yI/w5AJ8PWgV5qdAXYddaxqK
TLSH 2CA423A38E9E8F6FCCC6FD78D554921965A0FEE51439675C0B46EF2632C80CD20463AE
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Account <brant@nowoodfoundry.com>" (likely spoofed)
Received: "from nowoodfoundry.com (unknown [103.99.1.171]) "
Date: "06 Jan 2021 07:09:51 -0800"
Subject: "STATEMENT OF ACCOUNT AS ON DATE"
Attachment: "SOA.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1292.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a269b4e2c5d92be7010b9365c063d9a04df9c21227e0b90fa29e3f98dbcbc28f/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Suspicious
First seen:
2021-01-06 16:06:05 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
6 of 29 (20.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uju3jywf3ev6oailsns4ay6zubg7tqqse7qlsd5cty7zrw6lykhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a269b4e2c5d92be7010b9365c063d9a04df9c21227e0b90fa29e3f98dbcbc28f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a269b4e2c5d92be7010b9365c063d9a04df9c21227e0b90fa29e3f98dbcbc28f

(this sample)

AgentTesla

Executable exe 363de4e060c67ac8f0ecbc4b5bef9768a561e6c95dc26872a0c6258e9f3f71dc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 363de4e060c67ac8f0ecbc4b5bef9768a561e6c95dc26872a0c6258e9f3f71dc
  
Dropping
AgentTesla

Comments