MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9812f141b9811c4e4e6a8ec3bb42d97a1eb8ee4810855f0a462e033b82d48420. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9812f141b9811c4e4e6a8ec3bb42d97a1eb8ee4810855f0a462e033b82d48420
SHA3-384 hash: 55a44e147f50f4dcfc2e70006ef2ba85c8288e144fa08e18ace530ede336dc0ba45c1fa9ebf2588d8c39d077132790f3
SHA1 hash: de4c3a2335ca02e2ee59777b8a698666590fc82d
MD5 hash: 0883d3f637011ee186e033ffbbe6bbc9
humanhash: friend-diet-saturn-ohio
File name:Products specifications.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:555'461 bytes
First seen:2020-10-13 05:07:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:K2i7ej/LKBu+rCXEAzT2geXOmC4JaM2Jjzni7cORDAN8HOBRPxlVyGZW18QoVU:NUBFzAX2rem7IM2j+7cO1AdnxlVyJaXU
TLSH 4DC423DAB2C1EBCF019C3960843CB1571B7B9D5C97C729CD96B48D05B9E15B8C88BA0B
Reporter abuse_ch
Tags:AgentTesla Hostwinds rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-785564.hostwindsdns.com
Sending IP: 192.255.235.154
From: account <account.sales@veolia.com>
Subject: QUOTATION
Attachment: Products specifications.rar (contains "Products specifications - 20201012~PDF.exe")

AgentTesla SMTP exfil server:
shinfieldgroup.in:587

AgentTesla SMTP exfil email address:
spacco.logs@vizvec.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9812f141b9811c4e4e6a8ec3bb42d97a1eb8ee4810855f0a462e033b82d48420/
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 19:43:59 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tajpcqnzqeoe4ttkr3b3wqwzpiplr3sicccv6csgfybtxawuqqqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9812f141b9811c4e4e6a8ec3bb42d97a1eb8ee4810855f0a462e033b82d48420

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9812f141b9811c4e4e6a8ec3bb42d97a1eb8ee4810855f0a462e033b82d48420

(this sample)

AgentTesla

Executable exe 6fa3091f305d9f040aca294e296e92c3590ce397bbf650ee9f26e3bc744d1f6a

  
Dropping
MD5 a9ae05802c55ded3d56966cd0ff93727
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fa3091f305d9f040aca294e296e92c3590ce397bbf650ee9f26e3bc744d1f6a

Comments