MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9af7ee12c3f16e083e522b4b81fb721e176bde4215502abf8dc2f6ebab789712. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9af7ee12c3f16e083e522b4b81fb721e176bde4215502abf8dc2f6ebab789712
SHA3-384 hash: 9794853ce0cd4ba82b396308b53edab89f02e39a4ef0da409a54badaa0747efe81e70bcfe63e388595a2a2456b64bdbe
SHA1 hash: 8dbcb9736a4563c3aebbf9b0378ec8866933248b
MD5 hash: 01926ceedb940aead32349baa72824ad
humanhash: sierra-bravo-december-alpha
File name:order SS21-031 - A30.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:677'623 bytes
First seen:2020-11-13 01:40:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:b7HnSD33n9M3+paYyaOBQFGP4h1LMfeWfmuC2oX5HFcsNpf:b7AHmKZy7B+JseWeuC2oX5lcMf
TLSH 55E423316C40368D774E83B9EC2AF2F0C913B4B28F6518BB91646BB043FD9B199D641E
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25650.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9af7ee12c3f16e083e522b4b81fb721e176bde4215502abf8dc2f6ebab789712/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 04:59:29 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tl364ewd6fxaqpssfnfyd63sdylwxxsccvicvp4nyl3oxk3ys4ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9af7ee12c3f16e083e522b4b81fb721e176bde4215502abf8dc2f6ebab789712

(this sample)

AgentTesla

Executable exe 587cf31e6e23f0a2a06799111f1c0381f2d29187ab59cfee2f314cb6ae6ed349

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 587cf31e6e23f0a2a06799111f1c0381f2d29187ab59cfee2f314cb6ae6ed349
  
Dropping
MD5 197e9cdd9d3828b836a72dffc36ee9d6

Comments