MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ef35983f52aa114838207e32c48f92cd6393d2599a84dfc6aca62ec62d3573c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ef35983f52aa114838207e32c48f92cd6393d2599a84dfc6aca62ec62d3573c
SHA3-384 hash: adb51a14fc102d3fa867aa9a6aad044f675af332d4067be146fcfd134d1fa9c1784e8476aaa7c26b2784f6344258cd53
SHA1 hash: 1b3bd8f8cae62aee28df4d395e1ee8c4045ac489
MD5 hash: 9c0251c87fddced35703293cd21ea1e9
humanhash: texas-glucose-lemon-white
File name:inv0154232707018245677898.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:645'065 bytes
First seen:2020-08-04 12:57:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3DqPvYss+WS/W3u/3h8BsV/9ISUXbfLT/ZLOJqWRQGU4dN5Mr:zqPQ7hSu8RrV/7UX7LbZ6JFdor
TLSH B5D4333D3FAABD0A40C8E7486772738AE159D1FDD23497D05681A4D868CE7BF6B160E0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blinux.thesecurededicatedserver.com
Sending IP: 198.52.104.94
From: Accounts (Payable) <accountspayable@tippo-ie.com>
Subject: RE: Payment advise for invoice copy
Attachment: inv0154232707018245677898.rar (contains "inv0154232707018245677898.exe")

AgentTesla SMTP exfil server:
smtp.blueskypaclficgroup.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ef35983f52aa114838207e32c48f92cd6393d2599a84dfc6aca62ec62d3573c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 12:59:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t3zvta7vfkqrja4ca7rsyshzftldspjftgue37dkzjroyywtk46a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9ef35983f52aa114838207e32c48f92cd6393d2599a84dfc6aca62ec62d3573c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9ef35983f52aa114838207e32c48f92cd6393d2599a84dfc6aca62ec62d3573c

(this sample)

AgentTesla

Executable exe eaf9e97b4d055b54d926265c1859acf33153daaa94e95c23d4c0849b48c391b5

  
Dropping
MD5 37094b551591d756c98fdfa7123638e3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eaf9e97b4d055b54d926265c1859acf33153daaa94e95c23d4c0849b48c391b5

Comments