MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b31fb4663d9d8cbbcca44731af1a0ec767c88f3dc24d85c279044437573e13d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b31fb4663d9d8cbbcca44731af1a0ec767c88f3dc24d85c279044437573e13d2
SHA3-384 hash: 55d18279e911d369c08981bb22290c0e052f735b3a806551a207b1051506e7c20d0710ccd872c45153fe5f748c94e282
SHA1 hash: b4ac8bcc521d96e2600a9578193e33ff564b9256
MD5 hash: d4054f579bc80d959a37e216845ff3b9
humanhash: utah-illinois-stream-oranges
File name:contract.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:580'316 bytes
First seen:2020-08-19 11:25:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:rGalU9Fge8jmY/OMP2iLvoRwZn7uZZyLu7UTeu:rGakv8jzZPVzpoz7U7
TLSH AAC423FC99E213C82159C76BFD6A214C7B9202A118C2D18C6506CBA6E03DEDD579EEDC
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: m97173.mail.qiye.163.com
Sending IP: 220.181.97.173
From: 代姸杰 <daiyj@zih718.com>
Subject: contract ZIH
Attachment: contract.7z (contains "contract.exe")

AgentTesla SMTP exfil server:
dies.gr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b31fb4663d9d8cbbcca44731af1a0ec767c88f3dc24d85c279044437573e13d2/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 11:27:05 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmp3izr5twglxtfei4y26gqoy5t4rdz5yjgylqtzarcdovz6cpja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b31fb4663d9d8cbbcca44731af1a0ec767c88f3dc24d85c279044437573e13d2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b31fb4663d9d8cbbcca44731af1a0ec767c88f3dc24d85c279044437573e13d2

(this sample)

AgentTesla

Executable exe 418e6ce3fd66c68a594bada93ee5789ddfc4df367e3c1be735cd07fe078fbe99

  
Dropping
MD5 0bcd02ebe198565b4a8b0af05c08faeb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 418e6ce3fd66c68a594bada93ee5789ddfc4df367e3c1be735cd07fe078fbe99

Comments