MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9ac9a6dc4bce3231fc93ea237a4ab5251359e2de9d1beae7c49d7b2fafa9d93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9ac9a6dc4bce3231fc93ea237a4ab5251359e2de9d1beae7c49d7b2fafa9d93
SHA3-384 hash: b520711fe71478948e8d3f865e75572c118f13a082fb9f0aabb0e55b2efdc25a41e6ddf29eca9f5652a84cefabbeddfc
SHA1 hash: 2da056f92946aa5b39110cba9ca65c22cc84f26f
MD5 hash: 4aa24fa69bace311b56ed925048dde9b
humanhash: harry-cardinal-zulu-hot
File name:09000000090900.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:272'674 bytes
First seen:2020-06-09 05:45:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:nLkzlHsUUezFnjohos95EZIvmr/M4QQzLUN1WKhUeSZrAPfDxVEW:LulMXaih59iZq+M4QQMrhiEDx3
TLSH E54423231AB070A654473B4B07A75853954DD1342E84AB4A0E3BB2CEE9DE389D31BE77
Reporter abuse_ch
Tags:7z AgentTesla geo VNM


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.etrade.kiev.ua
Sending IP: 185.203.241.24
From: sales@thienphuseafood.com.vn
Reply-To: saleslink@yandex.com
Subject: Xác nhận thanh toán
Attachment: 09000000090900.7z (contains "09000000090900.exe")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.23900.165.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 05:47:03 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgwju3oextrsgh6jh2rdpjflkjitlhrn5hi35lt4jhl3f6x2twjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b9ac9a6dc4bce3231fc93ea237a4ab5251359e2de9d1beae7c49d7b2fafa9d93

(this sample)

AgentTesla

Executable exe f6213927e615e82229f62b234b3ae3ae6466a01c741f62413a5c926ea59f14ea

  
Dropping
MD5 d4cad253b742d15c3ea69277217d231e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6213927e615e82229f62b234b3ae3ae6466a01c741f62413a5c926ea59f14ea

Comments