MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c78b036fd9c21ed034df97fe6cc1ade3137f36e5edf22e1e9e2e808d028335c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c78b036fd9c21ed034df97fe6cc1ade3137f36e5edf22e1e9e2e808d028335c
SHA3-384 hash: 23bdd7b2771cacd6450e21a2afb2562f8aadac9c8e55951582245f97c1726d5da0d6ee95c1b51bb133486c8a9e19f55a
SHA1 hash: 1e190ca1b26e3c5996cda43d7066f54a01a5cb11
MD5 hash: dec097ee0b729ef9dcce9283b6a1689c
humanhash: south-chicken-tango-london
File name:Doc#662020094753525736.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:4'402'740 bytes
First seen:2020-06-08 08:09:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:GwoSdF8/H9JLsCoeGs5NeHBZwVUh/EajB8LbZ/HfoMhm5/EHzAHJD:G0F8P9JLsXAAH0VUCaN8XZ/HfDOsHc9
TLSH 4D1633D5F57034FF96C2B56C4A602A6B0AA3B3712ED8269C4F70AE06378574C3727366
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: Purchase <purchase@arabico.ae>
Received: from srv3.cpanelcloudserver.com (unknown [208.123.119.110])
Date: 8 Jun 2020 09:05:59 -0400
Subject: URGENT QUOTATION - arabico company dubai
Attachment: Doc#662020094753525736.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.19181.12957.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 08:11:05 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
33 of 47 (70.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tr4lanx5tqq62a2n7f76nta23yytp43ol3psfypj4luarubignoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9c78b036fd9c21ed034df97fe6cc1ade3137f36e5edf22e1e9e2e808d028335c

(this sample)

AgentTesla

Executable exe b8968bfb9319f3bffbc742c99a60acf9dcc47c24eaf92ce5d5c8233807093df8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8968bfb9319f3bffbc742c99a60acf9dcc47c24eaf92ce5d5c8233807093df8
  
Dropping
AgentTesla

Comments