MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d2920186d5b7e9a1ce62dc5c76f3905e21bcba235484d879f9c694980e4fc8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d2920186d5b7e9a1ce62dc5c76f3905e21bcba235484d879f9c694980e4fc8c
SHA3-384 hash: 85966dce5a2d86d32602a0d67b82be4c1483d4b935dc086758b4bb045ca592b736401391d59144dded80d2af08f7c465
SHA1 hash: a9f375422d6207a1db54e21039ca28fc67b2bed5
MD5 hash: 1f1d29691849ec53e55dffd42e8381ef
humanhash: hot-massachusetts-coffee-earth
File name:PO-17232.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'793 bytes
First seen:2020-05-28 14:42:39 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:29h5sa3k/5w0Ki+i8WUrrZhXXmSLTgdb83rg/PJcmUXQB/F/24npZltBqrg4ts5V:cia0xI7WUPZBdLTgb83c/SmzbpZl7qkl
TLSH B8842351089E3CD178721B4943E5D821A3FD33A2BDD3CBF818B91C2B2368D724665DA7
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: hameedentr@cyber.net.pk
Subject: Request for PO Top Urgent
Attachment: PO-17232.gz (contains "PO-17232.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Inject
Create hunting rule
Status:
Suspicious
First seen:
2020-05-28 15:02:23 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9d2920186d5b7e9a1ce62dc5c76f3905e21bcba235484d879f9c694980e4fc8c

(this sample)

AgentTesla

Executable exe 3427c2594dae4a281a8a2210032445c42b3287818d1e10b45a55b28f80372c35

  
Dropping
MD5 d3df91e1e29c798daddb81db6a97731c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3427c2594dae4a281a8a2210032445c42b3287818d1e10b45a55b28f80372c35

Comments