MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e13aae5d25df14c8ec998a4298c35c515a399637807ab94ac3cf9eb2b1e9ce9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e13aae5d25df14c8ec998a4298c35c515a399637807ab94ac3cf9eb2b1e9ce9
SHA3-384 hash: b80bfb8c7c6d718db950401cbb3908ce94a9874e63c69ecf696feab273122b7ea1b3e3fbc1c6b2d503cfbfc5dd94057b
SHA1 hash: 5eac5f0ea770b37a12ab1283b2ca855f21e98c7f
MD5 hash: b40948b69eca7f4323f66c55989c14a1
humanhash: virginia-cup-aspen-seven
File name:Reference details PO required.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:597'022 bytes
First seen:2020-07-30 08:28:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:SIdGhxKBfG1ToZlvj54bm3449K5HTjS0B/nSUPdU+GZ80q4KKp/d:SIdGhCG1c7jHo4UhT/tPe3K0qPKp/d
TLSH 4FC423E1070719809B4A462115271C01C9FABA72A5D3D46BD5FAB6DF3F8AFF3CE42684
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: volivesolutions.com
Sending IP: 37.49.224.123
From: Iily Williams <Mahadev@volivesolutions.com>
Subject: Re: Order Required Details And Shipment
Attachment: Reference details PO required.zip (contains "Reference details PO required.exe")

AgentTesla SMTP exfil server:
webmail.volivesolutions.com:587

AgentTesla SMTP exfil email address:
narendrababu@volivesolutions.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.11578.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e13aae5d25df14c8ec998a4298c35c515a399637807ab94ac3cf9eb2b1e9ce9/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 08:30:07 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tyj2vzoslxyuzdwjtcsctdbvyuk2hgldpad2xffmht46wky6ttuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/9e13aae5d25df14c8ec998a4298c35c515a399637807ab94ac3cf9eb2b1e9ce9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9e13aae5d25df14c8ec998a4298c35c515a399637807ab94ac3cf9eb2b1e9ce9

(this sample)

AgentTesla

Executable exe 7f2bd4e2510a0bbc2d9b47c90aea8d83e4cf42df957f3908628ff22730fd00f6

  
Dropping
MD5 deb8bf5b3dabe802227395612be4b451
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f2bd4e2510a0bbc2d9b47c90aea8d83e4cf42df957f3908628ff22730fd00f6

Comments