MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e0ca8580c1cc1a5e352f1aca35f7602584299c64be41691bac6b6917bafe059. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e0ca8580c1cc1a5e352f1aca35f7602584299c64be41691bac6b6917bafe059
SHA3-384 hash: 26695fa4810b128d7169b6a4dc8f6572303d230ed558a6b52228398c931df0ffb5e60fc5932ad405e8ac9363a6489bb2
SHA1 hash: 22203a85605669b83b74d9663017e026861caf2f
MD5 hash: 40947d77a5302bc2c455ac945e1274dc
humanhash: black-indigo-july-early
File name:Scanned from PNB Sales Office Copier.pdf.zip.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:458'346 bytes
First seen:2021-02-12 02:38:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Qc72fUybWqXRF0LAaiejFIAgBegFwNCj4X:QcKDuED0eAGegFwco
TLSH 8EA423D188FF555E8990E35B046A3F53C7067E308F5B6A738B196CBD9070565BA0FA0C
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Asaid<asaide@petronas.com.my>" (likely spoofed)
Received: "from petronas.com.my (unknown [104.216.251.52]) "
Date: "11 Feb 2021 18:37:10 -0800"
Subject: "Aw: INVOICE 3192116"
Attachment: "Scanned from PNB Sales Office Copier.pdf.zip.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e0ca8580c1cc1a5e352f1aca35f7602584299c64be41691bac6b6917bafe059/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-12 06:49:18 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tygkqwamdta2ly2s6gwkgx3wajmefgogjpsbnen2y23jc65p4bmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9e0ca8580c1cc1a5e352f1aca35f7602584299c64be41691bac6b6917bafe059

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9e0ca8580c1cc1a5e352f1aca35f7602584299c64be41691bac6b6917bafe059

(this sample)

AgentTesla

Executable exe 872243dcfd043d984136c2be7ab859d8d2480be48bba92ef3236d6b45fd1c9f4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 872243dcfd043d984136c2be7ab859d8d2480be48bba92ef3236d6b45fd1c9f4

Comments