MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0f997e9091321c05078c77a308ba21a665401e3393b7655014469bd258c5133. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0f997e9091321c05078c77a308ba21a665401e3393b7655014469bd258c5133
SHA3-384 hash: 66e6c89d25926a2267d07d9ccd5fb0161268bfa8394f8712bd4f83d54b1f78295c18b3413f73b0f2a1200faf1c505fe8
SHA1 hash: 0276b45e4631276b956f2e1b0093c432932f8777
MD5 hash: f03e019686d060f352c59f9683025805
humanhash: social-music-washington-harry
File name:INVOICE.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'406 bytes
First seen:2020-12-01 06:21:59 UTC
Last seen:2020-12-02 06:47:35 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:MzJyhLeQmQ0AQWIZIomAEb+M9UrmkmESIdhXYYb2+6F6Z5:Mzgj0AxIZIo92+2I/pb2+6YZ5
TLSH AFC423691E99A03B3F7CF294D71B451CBA38A7B4E0D1441CE3C2868DC765D3B01AAD9B
Reporter cocaman
Tags:z


Avatar
cocaman
Malicious email (T1566.001)
From: "Account<info@indogulfgroup.com>" (likely spoofed)
Received: "from indogulfgroup.com (unknown [92.118.190.190]) "
Date: "30 Nov 2020 23:21:03 +0100"
Subject: "PROFORMA INVOICE!"
Attachment: "INVOICE.Z"

Intelligence

File Origin
# of uploads :
4
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0f997e9091321c05078c77a308ba21a665401e3393b7655014469bd258c5133/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-01 06:22:07 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wd4zp2ijcmq4audyy55dbc5cdjtfiapdhe5xmvibiru32jmmkezq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b0f997e9091321c05078c77a308ba21a665401e3393b7655014469bd258c5133

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z b0f997e9091321c05078c77a308ba21a665401e3393b7655014469bd258c5133

(this sample)

AgentTesla

Executable exe 2b08660c05385174828189e7d4386af6e82dad631bf33a3ac6b75b1ee2928b51

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b08660c05385174828189e7d4386af6e82dad631bf33a3ac6b75b1ee2928b51

Comments