MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b9aebf64db66489f724917aacfe6916f42204748fbfcbe70f3009c6a8b3644c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b9aebf64db66489f724917aacfe6916f42204748fbfcbe70f3009c6a8b3644c
SHA3-384 hash: 6e14ea43acdd4fef0d3fb912bd6d03ba1e59bf36d59d082e7263be47b24a2a866f0a2f89c5e8ceac1cc3e00d191c03aa
SHA1 hash: af1e50aab3e73499059c7d1ea025b0cd0525cfc4
MD5 hash: a80ef8ca68ed4d7b9e7c05286eb16a85
humanhash: mike-beryllium-robert-seventeen
File name:Mutiara PO- 20000883 Mirrorkote WT back print.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:381'186 bytes
First seen:2020-07-21 10:07:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Ryn080hVzB3HfgK79iGRu0ElRHhcd9MME53lvu8t7uRcnsxO6/5L4HQg2WQrH3jC:7BB3Hfj3ZIBc7MMmlZt78BIy8HQg29Tm
TLSH E084235FA6D3D106020256C878752106CFEFB3A7677687FB6F9B1C267A0AEA406F010C
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.cinderllafashion.com
Sending IP: 45.95.169.119
From: 銅鑼生產計畫課-吳彥瑤 Nina <nina@pahsco.com.tw>
Subject: Mutiara PO- 20000883 ( Mirrorkote W/T back print).
Attachment: Mutiara PO- 20000883 Mirrorkote WT back print.zip (contains "aFOBBGzvsTh1zMw.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WYG.3846.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b9aebf64db66489f724917aacfe6916f42204748fbfcbe70f3009c6a8b3644c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 10:09:04 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=donox5snwzsit5zesf5kz7tjc32cebdur674xzypgae4nkftmrga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b9aebf64db66489f724917aacfe6916f42204748fbfcbe70f3009c6a8b3644c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1b9aebf64db66489f724917aacfe6916f42204748fbfcbe70f3009c6a8b3644c

(this sample)

AgentTesla

Executable exe 95f2db0071adb3c99b50c41ecdecbe4c6c18e9318bea7d8cd6743aff619a9f8f

  
Dropping
MD5 6bb57cfb4a60bb00cd39a5690f8fc56c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95f2db0071adb3c99b50c41ecdecbe4c6c18e9318bea7d8cd6743aff619a9f8f

Comments