MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9c155440c4b9052c0b31ffadc8dc6cf1115960e8a6cf3bd93fa3661316029f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9c155440c4b9052c0b31ffadc8dc6cf1115960e8a6cf3bd93fa3661316029f8
SHA3-384 hash: 79276eaeba24831e71bb59263a991005e04a5e224f516c42d2316741521c3d337e34b63c54ddbae2e66dd693e073e671
SHA1 hash: f89bd40fb9e50ca05c8b7de5dbd8e813a49cae6c
MD5 hash: 21d56c5aa7a2be2424ad985dcc3cb9a4
humanhash: mirror-solar-don-sad
File name:Proforma invoice.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:515'919 bytes
First seen:2020-08-27 08:29:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:QewES4/Mgbm/cefTlSu+V4EbQVXJeeFxSG7rJn3tING:QB+Mgi/cefabQVX0eegJ3tAG
TLSH 40B433BD0411C75BF3CA7FE75A0BBF29035996B3AA5916D7046E62B44BF93CE08006D8
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.coordinexworldwide.com
Sending IP: 192.163.200.36
From: Accounting Department <account@masdom.com>
Subject: Proforma invoice
Attachment: Proforma invoice.Z (contains "Proforma invoice.exe")

AgentTesla SMTP exfil server:
mail.transfastc.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9c155440c4b9052c0b31ffadc8dc6cf1115960e8a6cf3bd93fa3661316029f8/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 08:31:05 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3havkramjoiffqftd75nzdogz4irlfqorjwphpmt7i3gcmlafh4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d9c155440c4b9052c0b31ffadc8dc6cf1115960e8a6cf3bd93fa3661316029f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z d9c155440c4b9052c0b31ffadc8dc6cf1115960e8a6cf3bd93fa3661316029f8

(this sample)

AgentTesla

Executable exe 2d97cf9262ff136c4d4f42d29be1b0e119e48373acf969dbaf6aa0c188c5ab10

  
Dropping
MD5 cd283dbbff2d25ca2d273bee95282ad3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d97cf9262ff136c4d4f42d29be1b0e119e48373acf969dbaf6aa0c188c5ab10

Comments