MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eb8727b297506d209f8fdc69e620139d3c8c1ecab79dc9b6bacbe18dca8742f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9eb8727b297506d209f8fdc69e620139d3c8c1ecab79dc9b6bacbe18dca8742f
SHA3-384 hash: b4bb32ab279e1367688703abc2f962841d93f6b4cf3a2b63b581cd3d88705ffc507b4686740502013f4966081e6222dd
SHA1 hash: e194c5d9b03cd45682d7bba14e1e4d4520b55d75
MD5 hash: bcfdcafcad6a5c13e7a57310ec4f8bf1
humanhash: oregon-autumn-oklahoma-foxtrot
File name:Estado de Pago-PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:650'787 bytes
First seen:2020-08-19 12:20:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:XDHxzV4pTzDj1jLN2+uyyx0LZjQSCJ+Ioh3310qrO9TerplSVdKf6Efi:Lx8XDBs+uyy01jbZIohn1jS9MRi
TLSH 59D423D89D50DA873F0220E6DA1BC48418D39BC92FFB262F9CD1044B6FC9E26159BDA5
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gicoronado.hpservidor.com
Sending IP: 65.175.68.101
From: Eric Salsavilca <esalsavilca@pacifico.com>
Subject: FACTURACION ADELANTADA OTASS
Attachment: Estado de Pago-PDF.rar (contains "GimRyEHi4ONqTEe.exe")

AgentTesla SMTP exfil server:
mail.mehatinfo.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9eb8727b297506d209f8fdc69e620139d3c8c1ecab79dc9b6bacbe18dca8742f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 12:22:08 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t24he6zjoudnecpy7xdj4yqbhhj4rqpmvn45zg3lvs7brxfioqxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9eb8727b297506d209f8fdc69e620139d3c8c1ecab79dc9b6bacbe18dca8742f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9eb8727b297506d209f8fdc69e620139d3c8c1ecab79dc9b6bacbe18dca8742f

(this sample)

AgentTesla

Executable exe 242c24fef019f1a8a9f3c351b86c8a5a50a30cc562605a992b944c19f66f150f

  
Dropping
MD5 0607ab0327cdb80f6ca1c6d28d17225e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 242c24fef019f1a8a9f3c351b86c8a5a50a30cc562605a992b944c19f66f150f

Comments