MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1869b7cb0caf63d2d390eb8dca86f11b80e7260480a5c2e3b8e838f0d92c6f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1869b7cb0caf63d2d390eb8dca86f11b80e7260480a5c2e3b8e838f0d92c6f8
SHA3-384 hash: 6658e5121a7bcd32cd23654ca88dea9fb629ce26ee40932d81731359d48cbf74334dcb6bee0828e35e59203c4712ed2b
SHA1 hash: 68e8f70353179d490637d4a15f3f73f05fdf7965
MD5 hash: f099ddb36b161bb3f449a585de45804a
humanhash: idaho-oscar-mountain-blue
File name:我司已匯$23856 (Our remitted $ 23856).zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:551'829 bytes
First seen:2021-02-01 06:28:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:kj9FxsgZeDc2UxPG0uZIo7KRoxHKOXL9BBeT2gUkOC:6FxsqlxPnuZOoRXFeadkOC
TLSH 19C423D63597C39BB19E2A8F865FBB111C11A36A3C10C586C165EBBF50B0339B1FA09D
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Mandy - HC <admin@homeconceptsltd.com>" (likely spoofed)
Received: "from homeconceptsltd.com (unknown [45.137.22.59]) "
Date: "31 Jan 2021 15:52:40 -0800"
Subject: "=?UTF-8?B?5oiR5Y+45bey5YyvJDIzODU2IChPdXIgcmVtaXR0ZWQgJCAyMzg1Nikg?="
Attachment: "我司已匯$23856 (Our remitted $ 23856).zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1869b7cb0caf63d2d390eb8dca86f11b80e7260480a5c2e3b8e838f0d92c6f8/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 01:11:59 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgdjw7fqzl3d2ljzb24nzkdpcg4a44tajaffylr3r2by6dmsy34a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b1869b7cb0caf63d2d390eb8dca86f11b80e7260480a5c2e3b8e838f0d92c6f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b1869b7cb0caf63d2d390eb8dca86f11b80e7260480a5c2e3b8e838f0d92c6f8

(this sample)

AgentTesla

Executable exe ac532b1ea850bf15a2f6a7c979191be3be395e29d73f4adcd908168cb2677858

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac532b1ea850bf15a2f6a7c979191be3be395e29d73f4adcd908168cb2677858
  
Dropping
AgentTesla

Comments