MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e40ce0b7ee677d2cf399f9ed98437b09fa2f4e058a3fba50e08955b23a6fcd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e40ce0b7ee677d2cf399f9ed98437b09fa2f4e058a3fba50e08955b23a6fcd8
SHA3-384 hash: 6bf6dc4f912d35fa6a1adad554de89ae008ed6bf8d18c5b3483652ba8ee7a997edfbbe352ca2bd17ddd4764550d8f26c
SHA1 hash: 89a91c0343fae782acef43b589f8b67b6c3b8eb2
MD5 hash: cac9b9394644d1aff89f1e14f750f7a6
humanhash: chicken-crazy-mirror-jersey
File name:Payment details.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'014 bytes
First seen:2020-05-28 12:42:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:NC95EqWn3bwdTL1V1BTuwxvZwEt05Godl:4HEP3k11V1puc7yGodl
TLSH 929423ED832B3C715434215901DDBBEFDE657BEA833184A1A5E824435A8B4718F0BEE6
Reporter abuse_ch
Tags:AgentTesla r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.dirickx.mg
Sending IP: 213.136.83.114
From: Mohammed Samiuddin <rist.budapest@rist.hu>
Reply-To: Mohammed Samiuddin <rist.budapest@rist.hu>
Subject: RE: Payment Slip -Order no.PI 630113-JUN
Attachment: Payment details.r11 (contains "Payment details.exe")

AgentTesla SMTP exfil server:
smtp.desmaindian.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 12:51:13 UTC
File Type:
Binary (Archive)
Extracted files:
228
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9e40ce0b7ee677d2cf399f9ed98437b09fa2f4e058a3fba50e08955b23a6fcd8

(this sample)

AgentTesla

Executable exe ffd1a82e1d23f8ec7cc030091831a3977a1a1247790f8bd3d436c551059e9375

  
Dropping
MD5 2c1499507e05787da95d16818988fa6c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ffd1a82e1d23f8ec7cc030091831a3977a1a1247790f8bd3d436c551059e9375

Comments