MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9305853b7cbc57459165e81eb8a7d87f6fb88d7d0d0afe09c383698847b213e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9305853b7cbc57459165e81eb8a7d87f6fb88d7d0d0afe09c383698847b213e4
SHA3-384 hash: 66f45b04baab2a8d881aeb044470c6c9bb3b46d8eba55012940d7a90be359404a7ed0f12a298c22cb3fd6fb411f0149c
SHA1 hash: aa211f212f25ba587e947ecb2331dc9f51e82c27
MD5 hash: 174fa4092ab8ffb81f4e6abf58682206
humanhash: wyoming-robert-sweet-oklahoma
File name:BL Draft Original Shipping Document.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'085'157 bytes
First seen:2020-05-28 06:09:39 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 24576:eF3TMBncoOlb5Y6etbznrgAE/8Xuvl6b8tf1loeo+24wL6YengG+:eF3TMhcoOLY3t3nikiq8tNlvke7+
TLSH C7353396065E5F190AF838E6C71E2C3F4859118B4A6EF5B321E49CD31CB4F4DCAA36C6
Reporter abuse_ch
Tags:AgentTesla r09


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: linode.florix.net
Sending IP: 173.255.196.137
From: Transvision Int'l Logistics <sales@mailgoesbulkworld.live>
Subject: Shipment Details :BL/AWB DETAILS (AWB728590890733)
Attachment: BL Draft Original Shipping Document.r09 (contains "BL Draft & Original Shipping Document.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Script-AutoIt.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:42:17 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 9305853b7cbc57459165e81eb8a7d87f6fb88d7d0d0afe09c383698847b213e4

(this sample)

AgentTesla

Executable exe 63b2df67beaec43492dc1fb48b2a2419b9a04d919c6056d5155d819b28b163f7

  
Dropping
MD5 f3ad2d13863921c7642352176561e12f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 63b2df67beaec43492dc1fb48b2a2419b9a04d919c6056d5155d819b28b163f7

Comments