MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b
SHA3-384 hash: 67855e5afbac883722e44b6f21de0efdf750a6c35dd659fa7bacbcda5e8e30378b78809e6ecf162f8f3d31e6f9291bfb
SHA1 hash: e829803706ac2ea4763c2d69d46d15c72f48058d
MD5 hash: ee31ae344b5b7c30655e97566a616875
humanhash: river-asparagus-apart-sierra
File name:Sales Order.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:234'882 bytes
First seen:2020-06-30 06:03:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:t9zdzAMx+Z0/st1shxC2BodbqaTi4vuXZERLgYYoBzpCaj/MwU5DG0n6cHVbYCG:t9hk4st1shxC2BETil+F2j00nNHV8H
TLSH F33412B0D9632277BAB2551F3C1E150E967A47CE0B77F0622E0DC1B612D28845E5E87B
Reporter abuse_ch
Tags:AgentTesla lzh


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fi.itb.ac.id
Sending IP: 212.83.46.121
From: supri@fi.itb.ac.id
Reply-To: supri@fi.itb.ac.id
Subject: Re: Sales order
Attachment: Sales Order.lzh (contains "Sales Order.exe")

AgentTesla SMTP exfil server:
smtp.mail.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.10865.29869.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b/
Threat name:
ByteCode-MSIL.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 06:05:10 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t2jxithnc5tbb462ta65ccuszzmx3zlbtqn3belqjelnqjyglbfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9e93744ced176610f3da983dd10a92ce597de5619c1bb091704916d82706584b

(this sample)

AgentTesla

Executable exe 69da44af465f16620592883dd3c8024fef0e6974f4994846d7a8d95c17350816

  
Dropping
MD5 46ec4a3731806816b7d17e34424faf85
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69da44af465f16620592883dd3c8024fef0e6974f4994846d7a8d95c17350816

Comments