MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9281dfee00f305e92e5e98ddc1da570c217a35fe7a5ecc2c98bedc53b6797d38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9281dfee00f305e92e5e98ddc1da570c217a35fe7a5ecc2c98bedc53b6797d38
SHA3-384 hash: b41c9da4df3076c5f15d21a7175cac44ebf01965776ea74fe609c7b65cb2757bf8c5bcdc833ae77467484b595c7b9f1d
SHA1 hash: 1187b53286ae4063bad9f6b4fb0e9bb08a4fa5c5
MD5 hash: 2459bcdc47a84b45c18d3b72ddb662d5
humanhash: eleven-lake-glucose-cat
File name:AWB Copy ,6020154744.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'766 bytes
First seen:2021-01-26 06:41:25 UTC
Last seen:2021-01-27 09:22:24 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:EYRq70IypIF857jtWobjjm7VuPZwAh3OaDC9EbPk:EYk7DoLeVA3OaDC9EA
TLSH B4A42302159BB860024764BAD3E769CB7A70B54F050529D260DE7766B03B63AEE26F3C
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Dina Hossam <dina.hossam@dhl.com>" (likely spoofed)
Received: "from box.dertysm.xyz (box.dertysm.xyz [134.122.14.245]) "
Date: "Mon, 25 Jan 2021 18:40:17 -0600"
Subject: "AWB Copy ,6020154744"
Attachment: "AWB Copy ,6020154744.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.29537.26039.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9281dfee00f305e92e5e98ddc1da570c217a35fe7a5ecc2c98bedc53b6797d38/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 05:59:16 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ska573qa6mc6sls6tdo4dwsxbqqxunp6pjpmyleyx3ofhntzpu4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9281dfee00f305e92e5e98ddc1da570c217a35fe7a5ecc2c98bedc53b6797d38

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9281dfee00f305e92e5e98ddc1da570c217a35fe7a5ecc2c98bedc53b6797d38

(this sample)

AgentTesla

Executable exe 3c8032ddd2f77a14862946d88ec94bff2d42ea6b4cf59ac2942327f275a2a298

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c8032ddd2f77a14862946d88ec94bff2d42ea6b4cf59ac2942327f275a2a298
  
Dropping
AgentTesla

Comments