MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eb2194dbdb84ec00ceef6bc26720c07724b93b5f00c0cc542cf978cb5477308. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9eb2194dbdb84ec00ceef6bc26720c07724b93b5f00c0cc542cf978cb5477308
SHA3-384 hash: db983682ef02d6fe8c39114fd74cd4287bdab9bdefb676c488200d46be88f96ccd128f7440fb9ca5e13103fe9c2c5e25
SHA1 hash: 2806df19e275b5bff9d6ebbd95b804a0e861007a
MD5 hash: 0e1db7be4d241179418cefb4073f0f79
humanhash: whiskey-winter-colorado-carbon
File name:new order.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'115'829 bytes
First seen:2020-05-11 14:55:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:uUBNXwV7UPnbGFfj8BK0sMj61NOoIHe4ttNiKDTYiKeFZtiCPCSiXIP+GgcTdB:jU7UPnqpiskQNHRitN9TYiKExCRI+GTX
TLSH DA3533EC76B9561BF5115E2137F7242139097A42249C79DB3893FCA2AB08BFC216723C
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: main.oal.com.my
Sending IP: 103.8.26.32
From: Muhammad <nickfinlay@carpetlinedirect.co.uk>
Subject: Re: Purchase Order
Attachment: new order.z (contains "new order.exe")

AgentTesla SMTP exfil server:
mail.tipusurgical.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21190.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 15:37:14 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t2zbstn5xbhmadho626cm4qma5zexe5v6agazrkcz6lyznkhomea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9eb2194dbdb84ec00ceef6bc26720c07724b93b5f00c0cc542cf978cb5477308

(this sample)

AgentTesla

Executable exe 437d00efdb3e3514135b55fc3574fdf4e109d527f2c998bf614ceb33088effdf

  
Dropping
MD5 0de18d164e75ab0d3e622ffd37b976f7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 437d00efdb3e3514135b55fc3574fdf4e109d527f2c998bf614ceb33088effdf

Comments