MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d08d84a86ec979690f03418aafbd02d10d1ce3b0eb116e9c01cf5b12f645f73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d08d84a86ec979690f03418aafbd02d10d1ce3b0eb116e9c01cf5b12f645f73
SHA3-384 hash: 5d419252fc9e48c3fe43bf940916abe7669cbffaa83d1ce9e02b0a002807456243cdc63e3bef494d76999c01d420e574
SHA1 hash: 27e698109eb8028963e67de895c515107f2f0f24
MD5 hash: ccaa578de2320e226febf3901c5fd9a9
humanhash: juliet-timing-lactose-zulu
File name:delivery report20200616,pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:984'277 bytes
First seen:2020-06-16 05:38:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:ZSwP1JYQXlf3ZtJeSn9znD2psSxboPCyYl9cf:ZSwPfD53ZtJRn9znD2KA8BYH+
TLSH 8C25331F24F4A4761281A9F7A7222F277500ED4D95EA07024628CA57E33EBC2DD59A8F
Reporter abuse_ch
Tags:AgentTesla CHN geo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lsleds.com
Sending IP: 156.96.45.138
From: 高磊 <sales10@lsleds.com>
Reply-To: pinlapgeatan@gmail.com
Subject: 关于青岛中集合同的事宜20GPX1000
Attachment: delivery report20200616,pdf.z (contains "delivery report20200616,pdf.exe")

AgentTesla SMTP exfil server:
mail.bioaktif.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:40:07 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tuenqsug5slznehqgqmkv66qfuindtr3b2yrn2oadt23cl3el5zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9d08d84a86ec979690f03418aafbd02d10d1ce3b0eb116e9c01cf5b12f645f73

(this sample)

AgentTesla

Executable exe 72730bd3bf7565ec159df761ee9d6b0e641a4b818d136481de8ac30531f532c5

  
Dropping
MD5 8688db7ec132d5b2d6472b1d6ceb5943
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72730bd3bf7565ec159df761ee9d6b0e641a4b818d136481de8ac30531f532c5

Comments