MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ffc1c08898147c9e1ca82a4930d06a6335a5b2589402b1716d12e8dc11272f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ffc1c08898147c9e1ca82a4930d06a6335a5b2589402b1716d12e8dc11272f1
SHA3-384 hash: d69621f805c2704e3f3674bdf94034185317dd56df741894edf7772cfb4fcea7a9de215b31c7b8e40e94e0bdd6734290
SHA1 hash: 786f83b46b530301d40553c8573ecef4629dd818
MD5 hash: fe94a68d7589452fe1a49bc25e661ec1
humanhash: triple-diet-twelve-don
File name:HYD6345892022z.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:833'766 bytes
First seen:2020-08-28 05:49:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 24576:9hHvww9uBxd4LzQAmKvid3/QHjy7oKSx00tku4:9hIwUBxq0LKvWoq7Sx00+F
TLSH 96053310E3E1647F1F555A02F66ACB2B0F222159B43A4745FB2E72C85FE106A19DE3B3
Reporter abuse_ch
Tags:AgentTesla CHN geo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail-smail-vm88.hanmail.net
Sending IP: 211.231.106.163
From: otk8457@vip.163.com <otk8457@hanmail.net>
Subject: HYD6345892020
Attachment: HYD6345892022z.z (contains " HYD6345892022z_东莞市恒易达模具科技有限公司.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ffc1c08898147c9e1ca82a4930d06a6335a5b2589402b1716d12e8dc11272f1/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 05:51:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r76bycejqfd4tyokqksjgdiguyzvuwzfrfacwfyw2exi3qisolyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8ffc1c08898147c9e1ca82a4930d06a6335a5b2589402b1716d12e8dc11272f1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 8ffc1c08898147c9e1ca82a4930d06a6335a5b2589402b1716d12e8dc11272f1

(this sample)

AgentTesla

Executable exe 829abf5ae6cc64c2099d4e8f5160877ee47f82d9d8c29f24b47cee0aad726986

  
Dropping
MD5 4d0c1f6cdc29462d7025a937631a39fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 829abf5ae6cc64c2099d4e8f5160877ee47f82d9d8c29f24b47cee0aad726986

Comments