MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eb548f1f79d2c3a6bdc7919fab0684c023543d54db75855886761cfd6522c8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9eb548f1f79d2c3a6bdc7919fab0684c023543d54db75855886761cfd6522c8d
SHA3-384 hash: b2dc891e5df132958112e3ae5ea57ab408988ddfa680b6f4e04e12c04a597f82469f92d49f1495b6ec137b47f8f3921b
SHA1 hash: a7f8fffada7152a9d26801a084a16e92a523e1ea
MD5 hash: f685526546fd2a5fb65f04e53b4f0d40
humanhash: video-river-green-indigo
File name:Grupo Dani Order_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:172'067 bytes
First seen:2020-11-02 08:11:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:/V7mWrSMBxNCLuQx/SJiJpspzfa3oZsp4gUoG9PYvrATymqaxITYd:t7m80LlxmiJapz+2spq/NUyqNTYd
TLSH 44F3124C50BB7BE2C122EB1E81147684D8501C065BE7EEAE6488A67730D49709B5FEFF
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Marcelo Prieto<info@antalva.com>"
Received: "from antalva.com (unknown [185.125.204.39]) "
Date: "01 Nov 2020 23:35:59 -0800"
Subject: "Re: New Order Inquiry Grupo Dani "
Attachment: "Grupo Dani Order_pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis.11294.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9eb548f1f79d2c3a6bdc7919fab0684c023543d54db75855886761cfd6522c8d/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-02 07:33:21 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
9 of 48 (18.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t22ur4pxtuwdu264pem7vmdijqbdkq6vjw3vqvmim5q47vssfsgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9eb548f1f79d2c3a6bdc7919fab0684c023543d54db75855886761cfd6522c8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9eb548f1f79d2c3a6bdc7919fab0684c023543d54db75855886761cfd6522c8d

(this sample)

AgentTesla

Executable exe fcb5bb27ba081b53d3ff4a4c1793ef411898dc4892194b60b275b81e22173e89

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fcb5bb27ba081b53d3ff4a4c1793ef411898dc4892194b60b275b81e22173e89
  
Dropping
AgentTesla

Comments