MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb20e9ab60c879b309470d22d9c293b5c33af8371731482d402427c81487152e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb20e9ab60c879b309470d22d9c293b5c33af8371731482d402427c81487152e
SHA3-384 hash: bf1a1d96c1b406762a7e8ac1b6a479c8004b580c1f99e8c8ea89289b616265db22d648ca8651fd6567d6efcf54ff78d7
SHA1 hash: 5eed87aaf93de95472bde95fa57040fee3e67bc7
MD5 hash: 299a9fbb0327d4eac218af73d7a0dc8d
humanhash: robin-helium-lake-cat
File name:CONFIRM OUR NEW ATTECHED IMAGE AND SAMPLES ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:315'236 bytes
First seen:2020-09-28 07:10:00 UTC
Last seen:2020-09-29 05:23:27 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:aHwlpB2uspbfSKLSvsSxBMJ8jbDn3nrV7ppD0+WCd9CbZztWH2YQNm0b4:aHdbKK6zxKJ8jvnRPU4CbBvNVU
TLSH 0C6423D5746656CDD1251372190E839ED6668CFBE3F8A020D718C9A29D743AF9A0CF0E
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Rupesh. Patil<wizzy.max@bk.ru>"
Received: "from bk.ru (unknown [193.142.58.25]) "
Date: "28 Sep 2020 21:02:37 +0200"
Subject: "CONFIRM OUR NEW ATTECHED IMAGE AND SAMPLES FOR ORDER NO. 03135643"
Attachment: "CONFIRM OUR NEW ATTECHED IMAGE AND SAMPLES ORDER.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb20e9ab60c879b309470d22d9c293b5c33af8371731482d402427c81487152e/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-09-28 07:00:27 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmqotk3azb43gckhburntqutwxbtv6bxc4yuqlkaeqt4qfehcuxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bb20e9ab60c879b309470d22d9c293b5c33af8371731482d402427c81487152e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bb20e9ab60c879b309470d22d9c293b5c33af8371731482d402427c81487152e

(this sample)

AgentTesla

Executable exe 837c5548dc64287dc269d29eb7fba3822377be3e90ffd1203b1607cc1e86ab25

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 837c5548dc64287dc269d29eb7fba3822377be3e90ffd1203b1607cc1e86ab25
  
Dropping
AgentTesla

Comments