MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9377416922e3355aaaee4b620e0596baae2433e91a0dc741bc4fe482cb895bbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9377416922e3355aaaee4b620e0596baae2433e91a0dc741bc4fe482cb895bbe
SHA3-384 hash: 693d96f7bcd651022ae8d88333ad1b28160ca1b9d39976ae4b65bfaf00b926e8f175d433d216d1f7eec93f355a79c1b4
SHA1 hash: f28aa56a699134bd74e6aa18c83742c7a269abc9
MD5 hash: 9378ec3352d2414bd6a7c6597bd8613c
humanhash: illinois-florida-september-delta
File name:overdue.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:338'738 bytes
First seen:2021-02-16 06:33:56 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:idAJmnh7JRg/0YjMx+u+TV7wRQm7/UKEVP1qEpUUBrqHolEZHZqn2f1YUH87g2n+:KAJmnxg/0TJ+TeRQm7sxVPX4qEBf1jH3
TLSH DD7423A908AD6E45CE8F6596CF64876F8E3BB5D93005040542613AF0AEDDF8D8E41CAF
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Brenda" <brenda-md@oceanhanyu.com>" (likely spoofed)
Received: "from postfix-inbound-5.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237]) "
Date: "15 Feb 2021 12:46:38 -0800"
Subject: "Overdue Invoice"
Attachment: "overdue.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9377416922e3355aaaee4b620e0596baae2433e91a0dc741bc4fe482cb895bbe/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 17:34:00 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
8 of 29 (27.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sn3uc2jc4m2vvkxojnra4bmwxkxcim7jdig4oqn4j7sifs4jlo7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9377416922e3355aaaee4b620e0596baae2433e91a0dc741bc4fe482cb895bbe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9377416922e3355aaaee4b620e0596baae2433e91a0dc741bc4fe482cb895bbe

(this sample)

AgentTesla

Executable exe 8a44fabd61b1b7695fed4db543418ec7ceb0a7641035641d449254a9c458affb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a44fabd61b1b7695fed4db543418ec7ceb0a7641035641d449254a9c458affb
  
Dropping
AgentTesla

Comments