MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ba7ec5012e0af9fe559f0d239ed253f64c2686762053bc4f95073c71fcc9a1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ba7ec5012e0af9fe559f0d239ed253f64c2686762053bc4f95073c71fcc9a1b
SHA3-384 hash: 51a2081549bab3c330163e3e7e2b40c889823c7e138243882035f1e8409bee99213012087d08ceae842a069bfaf5422f
SHA1 hash: 4a895a0a05a2d01701e11c72fd4d99f0e17a5e74
MD5 hash: 89535fb9de502cbc7a070dfd1ea68a94
humanhash: fanta-friend-delaware-freddie
File name:FW RFQ.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:365'042 bytes
First seen:2020-07-16 05:15:11 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 6144:Jo94sr3MTFcfAfSgL7HWmS59WYYnWcuLwZl9LleKkIddNHT:K5r3MTOA1fcDGWNw5LQKBDz
TLSH 3F7423EDF4388267E40E32502D89444B6C3E603D2A6A9FD5384A9F9C6DF42F372D56E4
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email
From: Carie Gonzales <purchase1@oryx-ad.ae>
Received: from snakehead.swin.net.id (snakehead.swin.net.id [103.11.135.43])
Date: Thu, 16 Jul 2020 11:51:58 +0700
Subject: FW: RFQ
Attachment: FW RFQ.7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ba7ec5012e0af9fe559f0d239ed253f64c2686762053bc4f95073c71fcc9a1b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 05:17:04 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 9ba7ec5012e0af9fe559f0d239ed253f64c2686762053bc4f95073c71fcc9a1b

(this sample)

AgentTesla

Executable exe beb893e1685315584674c60f2f436c5213f0262467d3595161426b4cf485712d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 beb893e1685315584674c60f2f436c5213f0262467d3595161426b4cf485712d

Comments