MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9369d679cdf1acd55bc4226d55bbb2eba9bb330ebcf781ae2ac22e3eebb03af9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9369d679cdf1acd55bc4226d55bbb2eba9bb330ebcf781ae2ac22e3eebb03af9
SHA3-384 hash: e00af43ceb42378dfa9b3a9e1b2ebafc2533a4f76e1d43d585161cd43451cd4a8f8f8f94afe012b46d86e7dcab9de448
SHA1 hash: 2a561f8a893c2f1805ada28391479c6ec663749b
MD5 hash: ce19b46bdb5a86663b747ba5953384e5
humanhash: bacon-island-football-hydrogen
File name:Perfil Da Empresa.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'939 bytes
First seen:2020-07-22 10:07:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:O2E09hN317odgrDlG2Pm8mSyLJphzFDSKPG5RMp1wO3ma9/yvMnE4AinsTzvf9SK:O2E+N317F4cm8mBtphzpJiMwO33E496N
TLSH 9A8423D8C57409FB65A6AAC0152FB8B7C00900FD7AD97CC65D617AA2D3B1A09B7F0123
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blue115.dnsmisitio.net
Sending IP: 186.64.119.96
From: Javier Lavado <fernandez@heras.co.uk>
Subject: ORDEM C & F (PORTUGAL)
Attachment: Perfil Da Empresa.zip (contains "Perfil Da Empresa.exe")

AgentTesla SMTP exfil server:
smtp.pharco--corp.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9369d679cdf1acd55bc4226d55bbb2eba9bb330ebcf781ae2ac22e3eebb03af9/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 10:08:08 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=snu5m6on6gwnkw6eejwvlo5s5ou3wmyoxt3ydlrkyixd525qhl4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/9369d679cdf1acd55bc4226d55bbb2eba9bb330ebcf781ae2ac22e3eebb03af9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9369d679cdf1acd55bc4226d55bbb2eba9bb330ebcf781ae2ac22e3eebb03af9

(this sample)

AgentTesla

Executable exe cc910656492e850bcf5cb0f5889c55030ce5051224e275f36217e7c37f465ee1

  
Dropping
MD5 c5b1484b582aaf695b3796b88d3c5c18
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc910656492e850bcf5cb0f5889c55030ce5051224e275f36217e7c37f465ee1

Comments