MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f886f350af7093b4b1b7b93c7742f230b066d3921856461c6d36da4d14e36456. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f886f350af7093b4b1b7b93c7742f230b066d3921856461c6d36da4d14e36456
SHA3-384 hash: 3b41a6b982046b8cf963a6222ed6efe52e04b413ca2e75cfa4ee746d38b2d308d6971685c2020a21a7f22d961d22b2e4
SHA1 hash: 4d9fd63d28b45fd4d7f9d98cf726bd32560dd709
MD5 hash: 6844fdbe2f65d79b5919f7f24e5d4154
humanhash: charlie-lactose-march-arkansas
File name:Receipt.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'153 bytes
First seen:2020-12-04 21:16:08 UTC
Last seen:2020-12-05 09:51:32 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:QmiauXk5x2KoWPwF8mrteGjey5J8h1Xy4aj0YX2jc6D/xeZGyo7Vn/uRdqTIEMrW:QPaXQveGje8J8DiMzyZVo75WKT/
TLSH E294233D356DDC5FAD0F7F2C6FC51C1A88244AE86987924917B59F281B8CBF19880E89
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""emily.sun-szx" <emily.sun@worldwide-partner.com>" (likely spoofed)
Received: "from worldwide-partner.com (unknown [103.145.252.171]) "
Date: "04 Dec 2020 11:55:52 -0800"
Subject: "RE: Remittance Advice - From Worldwide Partner Logistics Company Limited 13 Dec 2020 08:13:58 -0700"
Attachment: "Receipt.zip"

Intelligence

File Origin
# of uploads :
3
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21508.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f886f350af7093b4b1b7b93c7742f230b066d3921856461c6d36da4d14e36456/
Threat name:
ByteCode-MSIL.Infostealer.Coins
Create hunting rule
Status:
Malicious
First seen:
2020-12-04 00:55:30 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7cdpgufpocj3jmnxxe6hoqxsgcygnu4sdblemhdng3ne2fhdmrla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f886f350af7093b4b1b7b93c7742f230b066d3921856461c6d36da4d14e36456

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f886f350af7093b4b1b7b93c7742f230b066d3921856461c6d36da4d14e36456

(this sample)

AgentTesla

Executable exe c9747168a0090d1b036e820b6e51b1983deded573227547901baa71f5914c7cc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9747168a0090d1b036e820b6e51b1983deded573227547901baa71f5914c7cc

Comments