MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9ffe98eb2f7cd604eadffd66ddb55b9b6d9be18f8e8f918f609e63dbbf222aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9ffe98eb2f7cd604eadffd66ddb55b9b6d9be18f8e8f918f609e63dbbf222aa
SHA3-384 hash: 0f7d08f20f713589d751c9a6dc4224a322c92f40584a4411256591f02e3e6f53fbaedddbfe90f5f7963d7fc2b39008e0
SHA1 hash: cea038e7af9dc0d2999c7a37efb2e44970807134
MD5 hash: d254b4f08e7b8d754c546cc9e0d2018f
humanhash: oven-mockingbird-east-uncle
File name:sars documents.r10
Download: download sample
Signature AgentTesla
Create hunting rule
File size:441'539 bytes
First seen:2020-05-27 11:34:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:A0dZzRg3XqKzESsLduEuTiGi7OzBdvWm/DtgGjbtvYV:A0dZG3XqKzESAdJsqiHjbtv2
TLSH B4942366BA7272B22FC8D55D8083ACE91282F258B0F44853DDFFC08EE54549D274E1BB
Reporter abuse_ch
Tags:AgentTesla r10


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corry.duckdns.org
Sending IP: 209.182.219.3
From: noreply@sars.gov.za
Subject: SARS eFiling Letter Notification
Attachment: sars documents.r10 (contains "sars documents.exe")

AgentTesla SMTP exfil server:
zstcznz.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 11:35:48 UTC
File Type:
Binary (Archive)
Extracted files:
276
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d9ffe98eb2f7cd604eadffd66ddb55b9b6d9be18f8e8f918f609e63dbbf222aa

(this sample)

AgentTesla

Executable exe 9a13981eb4fb532d207c90f4f5689d9ad4d9af29e2ddf7030d78c513330c4dbe

  
Dropping
MD5 6725c3a990c6e107fdbd4b9e80428119
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a13981eb4fb532d207c90f4f5689d9ad4d9af29e2ddf7030d78c513330c4dbe

Comments