MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9db74c9e5bdfc9e69af0186a5f7d712b2f10c87fd90b78b3e6778e349ccc913a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9db74c9e5bdfc9e69af0186a5f7d712b2f10c87fd90b78b3e6778e349ccc913a
SHA3-384 hash: c24a1442b39adc04cf539e444d4e325db0974a69870b8c23b7d75638853231d8ffa4495c59a9ec4571227b25c5e5d4f0
SHA1 hash: ae7b8acd918490eade32f63576be04f0f5a722ca
MD5 hash: fb76d1ecbeadd4b82fbe2726edf78b40
humanhash: georgia-hydrogen-monkey-spaghetti
File name:Transferencia Bancaria.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'194'586 bytes
First seen:2020-12-27 07:41:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:hPFL1zjeO01h5QvSEepKxQkS5yfw217JuNMce4:hdL1l01jizSEfx7JuM4
TLSH 40453307BCD7A3923CE8F50874D9C741279ACEE56CD8A0875BBA5B7C30CB811E981DA5
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dialhost.com.br
Sending IP: 177.52.160.32
From: Paula Oliveira da Silva <dfqs7ccf@sigestonline.com.br>
Subject: Comprovante de pagamento
Attachment: Transferencia Bancaria.zip (contains "Transferencia Bancaria.exe")

AgentTesla SMTP exfil server:
smtpout.secureserver.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.20809.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9db74c9e5bdfc9e69af0186a5f7d712b2f10c87fd90b78b3e6778e349ccc913a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-27 07:42:08 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tw3uzhs337e6ngxqdbvf67lrfmxrbsd73efxrm7go6hdjhgmse5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9db74c9e5bdfc9e69af0186a5f7d712b2f10c87fd90b78b3e6778e349ccc913a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9db74c9e5bdfc9e69af0186a5f7d712b2f10c87fd90b78b3e6778e349ccc913a

(this sample)

AgentTesla

Executable exe eff1bcca16d0e0e0838298d7595b9eb098d70bd47fd19fcb7e1e62c8109a7b0e

  
Dropping
MD5 639faff5ba5a0739952e8bb21d56a91b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eff1bcca16d0e0e0838298d7595b9eb098d70bd47fd19fcb7e1e62c8109a7b0e

Comments