MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9afc667f1954ea06d21ee8800603364c8d1a34bebdc17f26baf3fa68c1df35a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9afc667f1954ea06d21ee8800603364c8d1a34bebdc17f26baf3fa68c1df35a9
SHA3-384 hash: 30d63e8520cc8554dc950caf832f3eff9950829d3eb3ce3f29223ed9b5287fb089a135f58bc6c18c4b8c8e02b940f08d
SHA1 hash: 662c2af282e45a617d2a03bad24271f24a7f6ded
MD5 hash: 6c14253fbe93c9bb5979391f66824063
humanhash: thirteen-tennessee-east-happy
File name:Document pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:32'885 bytes
First seen:2020-10-12 09:46:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:et+cayzSFHEQcztTONi4uBL7s3Z53hFXHvls62SSrOqB:4nzohcztN4Usp5PXHvlNAOqB
TLSH DCE2F13B478751F6697CBDEC7E60CD88E75C3B028F7222788FEB99B585049344929326
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: zimbra58.go4hosting.in
Sending IP: 111.118.184.58
From: stephen@wescomail.us
Subject: New Enquiry - Wescomail Inc USA
Attachment: Document pdf.rar (contains "Document pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9afc667f1954ea06d21ee8800603364c8d1a34bebdc17f26baf3fa68c1df35a9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 08:49:22 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tl6gm7yzktvanuq65caamazwjsgrunf6xxax6jv26p5grqo7gwuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9afc667f1954ea06d21ee8800603364c8d1a34bebdc17f26baf3fa68c1df35a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9afc667f1954ea06d21ee8800603364c8d1a34bebdc17f26baf3fa68c1df35a9

(this sample)

AgentTesla

Executable exe 1e2ced0bf97c8caa6021784418f2edba1d0e618034fa15d83a0e8896e0936993

  
Dropping
MD5 183fa6cbd9709e563c3685fdcf7f0bfa
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e2ced0bf97c8caa6021784418f2edba1d0e618034fa15d83a0e8896e0936993

Comments