MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b
SHA3-384 hash: 67855e5afbac883722e44b6f21de0efdf750a6c35dd659fa7bacbcda5e8e30378b78809e6ecf162f8f3d31e6f9291bfb
SHA1 hash: e829803706ac2ea4763c2d69d46d15c72f48058d
MD5 hash: ee31ae344b5b7c30655e97566a616875
humanhash: river-asparagus-apart-sierra
File name:Sales Order.lzh
Download: download sample
Signature AgentTesla
File size:234'882 bytes
First seen:2020-06-30 06:03:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:t9zdzAMx+Z0/st1shxC2BodbqaTi4vuXZERLgYYoBzpCaj/MwU5DG0n6cHVbYCG:t9hk4st1shxC2BETil+F2j00nNHV8H
TLSH F33412B0D9632277BAB2551F3C1E150E967A47CE0B77F0622E0DC1B612D28845E5E87B
Reporter @abuse_ch
Tags:AgentTesla lzh


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: fi.itb.ac.id
Sending IP: 212.83.46.121
From: supri@fi.itb.ac.id
Reply-To: supri@fi.itb.ac.id
Subject: Re: Sales order
Attachment: Sales Order.lzh (contains "Sales Order.exe")

AgentTesla SMTP exfil server:
smtp.mail.ru:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 28
Origin country FR FR
ClamAV SecuriteInfo.com.CAP_HookExKeylogger.10865.29869.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Injector
First seen:2020-06-30 06:05:10 UTC
AV detection:10 of 48 (20.83%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 19.70%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments