MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9da867d7389572ebc80385d6d6bff96c351f5ef3036636c3ce5778ab06ce653d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9da867d7389572ebc80385d6d6bff96c351f5ef3036636c3ce5778ab06ce653d
SHA3-384 hash: 82b5c0f29ce63fdd4c6862b6ee05b8d8e3bfdcc05dc132df0eb2d24bf512c1909f3b34c4a204f562d051910e64156a89
SHA1 hash: 45ba1b189020b375eae1053e587548cec436cd16
MD5 hash: 345f339217aff59a3958be3799bce55a
humanhash: pluto-indigo-blossom-ten
File name:DO2001399_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:8'793 bytes
First seen:2021-02-26 06:53:40 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 192:O1sFfocIUagc9VKWP+o1Iia+N9CQgMoK2RmhEjmaazljQSJD:vFfXhagUKWGo1sE95dv2R3jaRJD
TLSH ED02AF9785DA03081CA346984B6B488F086DCDEA5D1EA5B0B12CD44DF1F9348EB0BE3C
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: repmaxint.com
Sending IP: 103.99.1.140
From: info@repmaxint.com
Reply-To: jamesadny@hotmail.com
Subject: PO-DO2001399
Attachment: DO2001399_pdf.gz (contains "DO2001399_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9da867d7389572ebc80385d6d6bff96c351f5ef3036636c3ce5778ab06ce653d/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 06:54:11 UTC
AV detection:
22 of 27 (81.48%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twugpvzysvzoxsadqxlnnp7znq2r6xxtantdnq6ok54kwbwomu6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9da867d7389572ebc80385d6d6bff96c351f5ef3036636c3ce5778ab06ce653d

(this sample)

AgentTesla

Executable exe 155fd2e71fa6a2962d5353bc3a2c307b06fc6b04ad205f50733e6e0e635c09ec

  
Dropping
MD5 98b3084239191f071af134303a3c7d75
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 155fd2e71fa6a2962d5353bc3a2c307b06fc6b04ad205f50733e6e0e635c09ec

Comments