MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9159b2f3767f77f852624dc98934b9522ac88dd1f753bbef992b991df9f55bc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9159b2f3767f77f852624dc98934b9522ac88dd1f753bbef992b991df9f55bc3
SHA3-384 hash: b629d675a1f78e5e185c3626178d4a6c3e1dcd02f3630356f5bf0b66a68a720ac6c78e8aa7b25d1f28bfe64ac71198e3
SHA1 hash: 83be962be54a9081b4ff30b90a5ef82d41744521
MD5 hash: 11fa4b22f95fc1f8ccba2c4f14542282
humanhash: avocado-twelve-foxtrot-ohio
File name:Pay-u Forms.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-17 08:38:43 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:n0AmSisAk8WgQ5AGJdZlCZjkvH8Ojh0sT+IQeIAFz+KI3nV5foGE3S6gmTir:npmSi/TDP0Zl4YP8FpIQfk+738h/T
TLSH 8145F189613F0C74E05B08350919797A21B2EEFB6BD551963E9E7617C3B33C67872A03
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dansmtp1.34503sgz0vpezcx1gncymdgvjc.xx.internal.cloudapp.net
Sending IP: 52.156.119.118
From: PAY-U INT'L <admin@dhI.com>
Reply-To: PAY-U INT'L <account_payu@f5.si>
Subject: PLEASE CONFIRM
Attachment: Pay-u Forms.img (contains "Pay-u Forms.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16131.27040.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9159b2f3767f77f852624dc98934b9522ac88dd1f753bbef992b991df9f55bc3/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 05:33:40 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sfm3f43wp537qutcjxeysnfzkivmrdor65j3x34zfomr36pvlpbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/9159b2f3767f77f852624dc98934b9522ac88dd1f753bbef992b991df9f55bc3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 9159b2f3767f77f852624dc98934b9522ac88dd1f753bbef992b991df9f55bc3

(this sample)

AgentTesla

Executable exe 4d302b4fd8564f5e3f9b505c0f342ec0e133fca6e5d0c6b3bd89746351561c5b

  
Dropping
MD5 68d0d379c53e2109ec75b26fc7b513e4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4d302b4fd8564f5e3f9b505c0f342ec0e133fca6e5d0c6b3bd89746351561c5b

Comments