MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9632d3304b3c47e81ac5dc18fd28373eeab24600492502d0b23e3f724c4aa50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9632d3304b3c47e81ac5dc18fd28373eeab24600492502d0b23e3f724c4aa50
SHA3-384 hash: 606b13f22f20d85ba17709a86cd6acad1bd9474fd3e50541e45352bdd535ebebc2ed9b915ad10f925c0fa13d60983c57
SHA1 hash: 49ca57e074963a523a21e1d15aa50d07f4d8f5dc
MD5 hash: c1645184c8269e76832cf773ee7e0d15
humanhash: michigan-burger-vegan-chicken
File name:PDF-34569876545677654567-7655612.lha
Download: download sample
Signature AgentTesla
Create hunting rule
File size:303'607 bytes
First seen:2020-08-04 13:37:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:XCTsQnaVbtiyIEdtIf22RQ0228FH7iuw4GT+fh7n2BiOJIWchrd1Amv:XCTsIqb1bI+2R85iuwYJCBDJgP
TLSH 4654233801FB555FC25B71C02D25EE4923CEB2E6D8687F1254CEA72C315E05E92AC79E
Reporter abuse_ch
Tags:AgentTesla lha


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp6.mailgatewaypro.com
Sending IP: 85.95.228.151
From: cuentas <cuentas@patiodelacartuja.com>
Subject: Re: Confirmación de aviso de pago
Attachment: PDF-34569876545677654567-7655612.lha (contains "PDF-34569876545677654567-7655612.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9632d3304b3c47e81ac5dc18fd28373eeab24600492502d0b23e3f724c4aa50/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:39:05 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7frs2myewpch5anmlxay7uudopxkwjdaasjfalilepr7ojgevjia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9632d3304b3c47e81ac5dc18fd28373eeab24600492502d0b23e3f724c4aa50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f9632d3304b3c47e81ac5dc18fd28373eeab24600492502d0b23e3f724c4aa50

(this sample)

AgentTesla

Executable exe 3153b96e0d31eb2901117a088ffcdbe7e88ba65660171b0f0d43295ea21a27b0

  
Dropping
MD5 b359f6f166a841a1eadb58deb2e9f58e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3153b96e0d31eb2901117a088ffcdbe7e88ba65660171b0f0d43295ea21a27b0

Comments