MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dec75607fc47dd0da86bd76d4f28e5eb6cc5fc95d0189c8e3105e17b2216d442. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dec75607fc47dd0da86bd76d4f28e5eb6cc5fc95d0189c8e3105e17b2216d442
SHA3-384 hash: 01b37f1c430bbc06cbe363cda99479825c0b418c1bd9901db027c7a5999ace62979b8f2b457b9932cbe565d9bb16ce88
SHA1 hash: f11b518584267631069cc43d572d479cc9e18631
MD5 hash: 1f6cab7c2b8fed5788077d2e5ccf4031
humanhash: cat-bacon-bravo-aspen
File name:ACS Group Trial Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'326'773 bytes
First seen:2021-03-12 08:02:52 UTC
Last seen:2021-03-13 11:28:56 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:iJ6MgyQ5weBZfUHYc9kDSFOQENiInHPcWIEj6iDIRlqfupvI2OP5O/rOm:iYMETZfPudEwInJJDIRlqfudI2KJm
TLSH 655533DF691AAF31A91338C51C0BA405B071874E6F939DECDA71F7B216A9EC108972C7
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "ACS Group Company Limited <sottoriva.live@live.com>" (likely spoofed)
Received: "from live.com (unknown [203.159.80.205]) "
Date: "12 Mar 2021 07:23:51 +0100"
Subject: "New Order Inquiry"
Attachment: "ACS Group Trial Order.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.16941.13475.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dec75607fc47dd0da86bd76d4f28e5eb6cc5fc95d0189c8e3105e17b2216d442/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 04:24:44 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 28 (60.71%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=33dvmb74i7oq3kdl25wu6khf5nwml7ev2amjzdrraxqxwiqw2rba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dec75607fc47dd0da86bd76d4f28e5eb6cc5fc95d0189c8e3105e17b2216d442

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip dec75607fc47dd0da86bd76d4f28e5eb6cc5fc95d0189c8e3105e17b2216d442

(this sample)

AgentTesla

Executable exe 4dad4127df36f1ff3db7fd7dcc70e776f043cb621e3ec297551ad1e187dae0a6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4dad4127df36f1ff3db7fd7dcc70e776f043cb621e3ec297551ad1e187dae0a6
  
Dropping
AgentTesla

Comments