MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99121c7c11bb444912d02000ce2e8a39b3e885d66889547ec8fb0c88906c22f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99121c7c11bb444912d02000ce2e8a39b3e885d66889547ec8fb0c88906c22f4
SHA3-384 hash: d6b6985d753b3a13480d85e4aee781d62eb41890924dcd8ec61ebe980b81046d7d90b337c85c079ecf54fbfa80d639a9
SHA1 hash: 35cf5968e0e587ab260e61ea1416b8884c50d080
MD5 hash: 271d8e87b589bef0329d9bae2f781d6a
humanhash: four-pluto-seventeen-nitrogen
File name:924OOR.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:219'486 bytes
First seen:2020-09-25 13:30:07 UTC
Last seen:2020-09-25 13:30:21 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:KIxSgP26dgP0FjHEYmHT/6Ui7srurovl3:Tn26M0FjHEPr6UiKurovl3
TLSH E024229D3AFE7249C34EF1DE7D916D22B306AB6D600B5CCBE93800672151B36056B6F0
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.ollytrade.com
Sending IP: 104.168.170.131
From: Simone Debernardi <info@ollytrade.com>
Subject: AW: 924OOR.xlsx
Attachment: 924OOR.gz (contains "NEW2009053 AZILIDE-500 REQ Flebo Complex.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99121c7c11bb444912d02000ce2e8a39b3e885d66889547ec8fb0c88906c22f4/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-09-25 09:21:46 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tejby7arxncesewqeaam4lukhgz6rbowncevi7wi7mgiredmel2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/99121c7c11bb444912d02000ce2e8a39b3e885d66889547ec8fb0c88906c22f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 99121c7c11bb444912d02000ce2e8a39b3e885d66889547ec8fb0c88906c22f4

(this sample)

AgentTesla

Executable exe afb7a097cebd29157285861e7bac37648c92243143b560772e652fa87b8aed6b

  
Dropping
MD5 bb50c3801cd04f6bf71de9e9fa609c92
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 afb7a097cebd29157285861e7bac37648c92243143b560772e652fa87b8aed6b
  
Dropping
SHA256 e3065a6f8e49ccda273bf283c18b9344cc9ad802c1065b0fdf45cdafe92d1029
  
Dropping
MD5 d2aafdfed54b960417358637196beaa5

Comments