MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b2aa44804b494a0aedbc681764d91ee5a49610ccfcfb2f6f78969e3bbf55fa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b2aa44804b494a0aedbc681764d91ee5a49610ccfcfb2f6f78969e3bbf55fa7
SHA3-384 hash: 40fa04a9cf951a6411f435ed95395957da777b2d02dbd40e6a26504313b5dce5001b8f24fd290a8af1c26880618cd2c2
SHA1 hash: d541f15fc194c7a06d53a7336ced1194a9ea65cb
MD5 hash: ed4f578d291d1dbcdc556eaa708b41e9
humanhash: tango-lamp-edward-fanta
File name:shipping document.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'572'864 bytes
First seen:2020-12-22 06:40:40 UTC
Last seen:2020-12-22 06:44:23 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:PUzwNc7PSyVwJRjl8mFSkVXeUeYrzo67w:nNtyVwRjOlkVXfPo6
TLSH F7759E303AEE6619F073BF755AD07596AAFEF6236303D41938A1038B4713D81DEA153A
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Service <mmahmed@kisr.edu.kw>" (likely spoofed)
Received: "from medeortz.co.tz (medeortz.co.tz [196.41.32.154]) "
Date: "Tue, 22 Dec 2020 03:20:49 +0300"
Subject: "New DHL Shipment Document BL,INV And Packing List Attached"
Attachment: "shipping document.img"

Intelligence

File Origin
# of uploads :
2
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.474.1876.11561.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b2aa44804b494a0aedbc681764d91ee5a49610ccfcfb2f6f78969e3bbf55fa7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 01:20:42 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tmvkisaewskkblw3y2axmtmr5znesyimz7h3f5xxrfu6ho7vl6tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b2aa44804b494a0aedbc681764d91ee5a49610ccfcfb2f6f78969e3bbf55fa7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 9b2aa44804b494a0aedbc681764d91ee5a49610ccfcfb2f6f78969e3bbf55fa7

(this sample)

AgentTesla

Executable exe c08d6151741d6906767aef938ccd845f610109a4fe775c2d52ece1bc9132e114

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c08d6151741d6906767aef938ccd845f610109a4fe775c2d52ece1bc9132e114

Comments