MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d9f2ecb500bd387037a37c1133af0cb896d1d06a090e128f2b4e49d6b6658de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d9f2ecb500bd387037a37c1133af0cb896d1d06a090e128f2b4e49d6b6658de
SHA3-384 hash: a038da073be668820effdcdbe98774aa9b622c0454378bfb6c8228852ff7fd0dcc10309b0df0ab12a145bbaf5e1c05c8
SHA1 hash: 4793d9c31ae08954d8293066bca439ea6269ead4
MD5 hash: 8ef9504d56cdc2c38a17b35534857f88
humanhash: uranus-nitrogen-apart-purple
File name:Court Order_PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:393'867 bytes
First seen:2020-07-16 07:59:58 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:5XPkgsQMXQezpjGeRU5VgK3F+j4HL/t3kZBLF:VMX7tGqfKVlr/CjLF
TLSH 5084233096A6CB7CAE07B6B0911BCDE35E71047B15719AE19706FE871B7F3363185222
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.310.biniomunidos.ml
Sending IP: 45.125.66.116
From: Court Of Justice <noreply@biniomunidos.ml>
Subject: Re: Court Order
Attachment: Court Order_PDF.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
smtp.elittacop.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d9f2ecb500bd387037a37c1133af0cb896d1d06a090e128f2b4e49d6b6658de/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-16 08:01:05 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=twps5s2qbpjyoa32g7argoxqzoew2higuciockhswtsj223gldpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9d9f2ecb500bd387037a37c1133af0cb896d1d06a090e128f2b4e49d6b6658de

(this sample)

AgentTesla

Executable exe 1585d935d47ff234d4b9a71e4f30d0731677d06f430894496c58153011bb90b7

  
Dropping
MD5 d1c3278d317750fbd5a9dcae7de2e27c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1585d935d47ff234d4b9a71e4f30d0731677d06f430894496c58153011bb90b7

Comments