MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f36725e6fb4da28e927e0637b36e71e56ad7ee8beb083716aba164d3425099f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f36725e6fb4da28e927e0637b36e71e56ad7ee8beb083716aba164d3425099f
SHA3-384 hash: 7c73f92056c0dcedc65bd45b1a702752255ffc7bd56f781e15bfa9de34a1d8bad25a1d032416546f0c24a51e31b98c27
SHA1 hash: 3b1ff72cb77bb2b33fad17e98f63823481d1dfca
MD5 hash: 385d604688f56317fbeae679bc9ba59f
humanhash: paris-wolfram-monkey-aspen
File name:new efs-specialist order.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2020-05-01 13:04:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:KsGEe8yJ8+2h9fm0b73SsQamUHxItROqXagnaPQYa+SRp:KkeNJgbTSwmSxupYa+S
TLSH A755E02705961A77FAFD91F4D46590838FF161736282FB5E6758C2BE0D86B30CA033A6
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.livemail.co.uk
Sending IP: 213.171.216.60
From: sales <irgen@efs-specialist.co.uk>
Reply-To: irgen@efs-specialist.co.uk
Subject: Order Inquiry
Attachment: new efs-specialist order.img (contains "new efs-specialist order.exe")

AgentTesla SMTP exfil server:
business43.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.43686.22580.21375.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 04:09:09 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t43hextpwtncr2jh4brxwnxhdzlk27xix2yig4lkxile2nbfbgpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 9f36725e6fb4da28e927e0637b36e71e56ad7ee8beb083716aba164d3425099f

(this sample)

AgentTesla

Executable exe 5d89c6925f0bbefb302df735868b57a02d2b9035b12c88be37fb32c7b1017306

  
Dropping
MD5 7965ecfb8dec87d9b04408968cc02280
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d89c6925f0bbefb302df735868b57a02d2b9035b12c88be37fb32c7b1017306

Comments