MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d5d5220565e4ff60c4a08dcaa73f074ae75a92dc7158faea742d79ba9efdf1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d5d5220565e4ff60c4a08dcaa73f074ae75a92dc7158faea742d79ba9efdf1d
SHA3-384 hash: f9920a0656a3bbaf96151a2b5b11573d58e78d41133cc99d9a872f085f7116cc77d83aa7bbdc78d55e1462cb991a56fa
SHA1 hash: db06a2c7b81a149dbf4e1bb7e14384c9db7cf4db
MD5 hash: d51eeb953fe93e273aa16f5ef22619fb
humanhash: alaska-south-paris-crazy
File name:New Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:583'137 bytes
First seen:2021-02-17 10:39:03 UTC
Last seen:2021-02-19 20:55:38 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:sg3sGebKqNOGk9uzWmPyfYXnMYDMkcTZby7Oc3ZnjPVPUStRlvY:sqsGebKql3MS0ZCd8
TLSH E1C423F3725E63289A9D857A3C598934243D73DC0192E0E6B27ECAD343E0590B8D67DB
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Marlene Burdorf <info@statesentry.live>" (likely spoofed)
Received: "from laboratorioraly.com (laboratorioraly.com [186.73.112.106]) "
Date: "Wed, 17 Feb 2021 01:35:49 -0800"
Subject: "New Order"
Attachment: "New Order.zip"

Intelligence

File Origin
# of uploads :
28
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20634.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d5d5220565e4ff60c4a08dcaa73f074ae75a92dc7158faea742d79ba9efdf1d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 10:39:05 UTC
File Type:
Binary (Archive)
Extracted files:
95
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvoveicwlzh7mdckbdoku47qosxhlkjny4ky7lvhillzxkpp34oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d5d5220565e4ff60c4a08dcaa73f074ae75a92dc7158faea742d79ba9efdf1d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9d5d5220565e4ff60c4a08dcaa73f074ae75a92dc7158faea742d79ba9efdf1d

(this sample)

AgentTesla

Executable exe 213d438ca097826c2ef69d2fa9210cc760825f4be66460ab90bd31452e47c79a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 213d438ca097826c2ef69d2fa9210cc760825f4be66460ab90bd31452e47c79a
  
Dropping
AgentTesla

Comments