MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dba3421a16521bca87c30bf529155b5fec3280b386ea4987e47afb002044316a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dba3421a16521bca87c30bf529155b5fec3280b386ea4987e47afb002044316a
SHA3-384 hash: 35385a51532914b4795603d4e92a0c8abccc59148b264a22a51251266e9b1fad4824996ccf4a4748dde9ad71e73ccf08
SHA1 hash: 8aba2f6e66a63263c50d7693d2d1ef28ee7762be
MD5 hash: b41ee7d012d4526a3a41aa686bd67591
humanhash: quebec-mango-freddie-harry
File name:2D sketches.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:305'066 bytes
First seen:2020-07-22 08:13:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:/EQdPRg6sfG+p+l2Gh8CRCFXeym+0ShVN/OA67:PdwG++2iRAFXeymIXN/w7
TLSH B85423DBD9DFB21AC70C2FD72654C6A0A0C2DD05024B66FB2452946F38E13BFE8469B4
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: m199178.mail.qiye.163.com
Sending IP: 123.58.178.199
From: Right Cheung <sales08@shinepackaging.com>
Subject: Re: High-end items inquiry
Attachment: 2D sketches.zip (contains "2D sketches.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dba3421a16521bca87c30bf529155b5fec3280b386ea4987e47afb002044316a/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 08:15:08 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3oruegqwkin4vb6dbp2ssfk3l7wdfaftq3vetb7epl5qaicegfva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dba3421a16521bca87c30bf529155b5fec3280b386ea4987e47afb002044316a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip dba3421a16521bca87c30bf529155b5fec3280b386ea4987e47afb002044316a

(this sample)

AgentTesla

Executable exe 5da82dd52f913ff5d416ec5479133a0f89cd5d835d2fbd964f32191f642ca9fa

  
Dropping
MD5 237d5d591b068bc36042b20c2c6a9532
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5da82dd52f913ff5d416ec5479133a0f89cd5d835d2fbd964f32191f642ca9fa

Comments