MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c961bed93b2e22ec2963da3726ae08f399a14f432d87869a801b86ab3c6feaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c961bed93b2e22ec2963da3726ae08f399a14f432d87869a801b86ab3c6feaa
SHA3-384 hash: 8231ebe08c91cccc5a96a6f5e3e1f5b52be86152970002eed78ad30326131d08efc2e7455ff4e8ae32ee44157633e3f5
SHA1 hash: 0a303d240849634cdb947300f7e159ad76a4f6bb
MD5 hash: c0c9c90b564dd108d8e57172c061dcc2
humanhash: bakerloo-rugby-red-harry
File name:Balance Payment.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:663'469 bytes
First seen:2020-06-04 17:31:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yHwck+CzeJqqWKDAn/8rksPQeLCmznSCPfjAVodUcSDtqojnCvIAiIES:yVk7ze+KDQ0FYeLHTfjAVCUZqoTCb7
TLSH 9BE43332826CD240C3AB67108052D74BDA632FEE5742ADCB15D2CA3C5CE19E7C7D9E1A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tkcpa.com.hk
Sending IP: 95.211.208.25
From: Accountant <account@tkcpa.com.hk>
Subject: Apology - Delay in payment
Attachment: Balance Payment.zip (contains "Balance Payment.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 17:36:16 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tslbx3mtwlrc5quwhwrxe2xar44zufhuglmhq2niag4gvm6g72va._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9c961bed93b2e22ec2963da3726ae08f399a14f432d87869a801b86ab3c6feaa

(this sample)

AgentTesla

Executable exe af7ab73a85ac84839b8bf10ff75f3363c7556ca5f262b8ddec9588835314a494

  
Dropping
MD5 9954ce452ffe970f5c214b2f97d66184
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af7ab73a85ac84839b8bf10ff75f3363c7556ca5f262b8ddec9588835314a494

Comments