MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9be483b9bcc212950e314d5ca707fff1c18bff424c31130ad5c748c2fbba568. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9be483b9bcc212950e314d5ca707fff1c18bff424c31130ad5c748c2fbba568
SHA3-384 hash: 0a5279c1224c5339138fd06213cffa0220c8c004a69b1c7e6ecb94e2c5352e8a82ee71a322f5f706b839110cffbec4f1
SHA1 hash: cc842b298eb4db9f032aec4d4560c25a7df76cde
MD5 hash: 77a5a080086f8a54ecd2b4cf902ba1c5
humanhash: football-fix-michigan-friend
File name:invoices.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:419'708 bytes
First seen:2020-07-29 06:39:04 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:61JR97fU/ZrNsUpRtROLrRtf7F2GaH2S8KU3e8wUoKZe9ERVl6qmea6CXSk:6PRxg5sOLYLttfQGD73rww496HmFtXx
TLSH 0A94234E4A200DC75D4643FC8A8C5909DFDE5F0AC9A4ABD54FE44AAAE0C2D61F22F53D
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: chgms.com
Sending IP: 95.211.253.203
From: info@chgms.com
Subject: Re: COA FOR APPROVAL
Attachment: invoices.r00 (contains "invoices.exe")

AgentTesla SMTP exfil server:
mail.nilgirisfoods.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9be483b9bcc212950e314d5ca707fff1c18bff424c31130ad5c748c2fbba568/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 02:25:59 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3g7eqo43zqqssuhdctk4u4d774obrp7uetbrcmfnlr2iyl53uvua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9be483b9bcc212950e314d5ca707fff1c18bff424c31130ad5c748c2fbba568

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 d9be483b9bcc212950e314d5ca707fff1c18bff424c31130ad5c748c2fbba568

(this sample)

AgentTesla

Executable exe d8c72023bdedf6714432a1263bcf0348278b580ae0099b3d3b0403862c081ac2

  
Dropping
MD5 971c8fc0f91b2bc048b239e464a8c8cb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8c72023bdedf6714432a1263bcf0348278b580ae0099b3d3b0403862c081ac2

Comments