MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e9e17ed6dd95447209e70b2cd44cc2c2be0a6e17b7180342d942a0cdbfea06a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e9e17ed6dd95447209e70b2cd44cc2c2be0a6e17b7180342d942a0cdbfea06a
SHA3-384 hash: 8d83515fdc1d004390e221833180a3c3424b361e46e39e61b6d80faad7ba3717a25a2bd87a371fa9e917d23d9ea68980
SHA1 hash: a1d4bf516bbbb6c914b847e878f33586af936d0e
MD5 hash: 95e8545d2a7b339d1054bda726e41e0f
humanhash: fourteen-beryllium-delta-kentucky
File name:BL Payment Swift_PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'388 bytes
First seen:2020-05-11 08:06:46 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:HtUGlTbpx86uiM4/2yToe8TZFmNwS+h6pqRJF3Kd7:245tuI2QwFmw64RJFK5
TLSH 10842301604A7B6FCD8A3DA65AAD0F36E36F1DC41714D764226150BD806A8E63FCBB6C
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: achilles.noc.ntua.gr
Sending IP: 147.102.222.210
From: KangQian Wong <rs12704@central.ntua.gr>
Subject: Balancing Payment Quote SSL-20040295
Attachment: BL Payment Swift_PDF.gz (contains "BL & Payment Swift_PDF.exe")

AgentTesla SMTP exfil server:
mail.candenizcilik.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:46 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2pbp3ln3fkeoie6oczm2rgmfqv6bjxbpnyyanbnsqvazw76ubva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 8e9e17ed6dd95447209e70b2cd44cc2c2be0a6e17b7180342d942a0cdbfea06a

(this sample)

AgentTesla

Executable exe c0005ff458131bed0541695d27368d84415e219dbdaa6d13fa80ed539e85b90f

  
Dropping
MD5 947e7f37cba394e7fde73b34612d8716
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c0005ff458131bed0541695d27368d84415e219dbdaa6d13fa80ed539e85b90f

Comments