MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3
SHA3-384 hash: 8c0f897604382e24feee66a92b2b21bd3a693f4369acfb31a567b7ec9aa863700380b5ce8d9922ed4262afa9b09e7507
SHA1 hash: f23a58b19dd98b55c317b17062fbe240ba81d20b
MD5 hash: a5ac2894bc7fef32be453553e64e9b9d
humanhash: arkansas-eight-batman-fish
File name:IMG-67890987654456787656789876-76567.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:313'837 bytes
First seen:2020-08-10 11:42:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:wgxzkRXFa/951levN+ribIC3zJYZoMiOMqPEcNHZydHuUp64HC:/zkRXc95LFibIC3NSoSku5ydl64HC
TLSH 686423B66F5D82893B03412936C767E6AE1E36B50EB8BDDB1FFB9111582F70CC512224
Reporter abuse_ch
Tags:AgentTesla ESP geo gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server5.magi.net
Sending IP: 192.243.105.163
From: cuentas <cuentas@aluwheelmx.com>
Subject: Re: Confirmación de aviso de pago
Attachment: IMG-67890987654456787656789876-76567.gz (contains "IMG-67890987654456787656789876-76567.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23535.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7mvb7uu3ooth6hfae6faijfj572uxj5yargykluq7q2sl2kpprq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3

(this sample)

AgentTesla

Executable exe acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d

  
Dropping
MD5 e485beb2bd8d7b87fae26065cb2f1951
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d

Comments