MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b8e3e513139c251b360c56eaa1f804835069457dc0ddcbb08e96e8ccb5d23d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b8e3e513139c251b360c56eaa1f804835069457dc0ddcbb08e96e8ccb5d23d4
SHA3-384 hash: 0c9c5691dffe7dcc0220851f6d6e8c616ba07cd84d56e74b20a4760b886cb81fb1f8b4c19c0bb557cd522283bbba5dda
SHA1 hash: c9b094caf3d7638009f0e7f7f0720fb1eb52b7b5
MD5 hash: eec108c2aca02ce7b98e8b605ee8ea43
humanhash: triple-angel-fish-illinois
File name:ADDITIONAL COST OFFER FOR TB HILTI SHOWROOMS FACADE ALUMINIUM COMPOSED PANEL CLADDIND COMMENTED 13.
Download: download sample
Signature AgentTesla
Create hunting rule
File size:564'179 bytes
First seen:2020-08-30 05:56:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:n9rWAb76TkRdGSPkFkhoG1Z+pSlIwdNq8/wleF1HB6kA5:n9aAb7uSPikiG1SQ7f7FlnA5
TLSH 07C42331D8B8F9CE03095B72EA345E2E3CB84BF89BB431E4265B2506D9577F6746043A
Reporter abuse_ch
Tags:AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 156.96.45.152
From: RASHID MOHAMED <thuyxnkr2019@gmail.com>
Subject: HBK Project - C1250/P5802 - REPLY TO LETTER FROM GD REF: HH-GL-124-TO-AKI-20 - ADDITIONAL COST OFFER FOR TB & HILTI SHOWROOMS (08.29.2020)
Attachment: ADDITIONAL COST OFFER FOR TB HILTI SHOWROOMS FACADE ALUMINIUM COMPOSED PANEL CLADDIND COMMENTED 13. (contains "ADDITIONAL COST OFFER FOR TB & HILTI SHOWROOMS (FACADE ALUMINIUM COMPOSED PANEL CLADDIND (COMMENTED) (13.07.2020.pdf (322 KB).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b8e3e513139c251b360c56eaa1f804835069457dc0ddcbb08e96e8ccb5d23d4/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Suspicious
First seen:
2020-08-30 01:40:13 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tohd4ujrhhbfdm3ayvxkuh4aja2qnfcx3qg5zoyi5fxizs25epka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9b8e3e513139c251b360c56eaa1f804835069457dc0ddcbb08e96e8ccb5d23d4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9b8e3e513139c251b360c56eaa1f804835069457dc0ddcbb08e96e8ccb5d23d4

(this sample)

AgentTesla

Executable exe bbb1cd2d138cd5331c4a1ef19a81688c45704fe3e96dbda7b7ffd8317b70fd84

  
Dropping
MD5 8788dca57f90d886f7b9c0397e9e75c7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bbb1cd2d138cd5331c4a1ef19a81688c45704fe3e96dbda7b7ffd8317b70fd84

Comments