MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f152c918754d526cdfdfc80bc9bc2f07a29c464ca1920e4fbd882479758a738. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f152c918754d526cdfdfc80bc9bc2f07a29c464ca1920e4fbd882479758a738
SHA3-384 hash: 5430b2e0e26a40c3c66016fda770b331ca00c009efd2940fe95c6b537c03fd4e03bbf6cf8aa7654286c47b6f30b0066e
SHA1 hash: 9f753bf82b60f60b9c7e8b6423f648bdb4730aa4
MD5 hash: faa4b5cbad4d74d863d8071ca43c0943
humanhash: blossom-happy-two-queen
File name:New Order0770.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:469'929 bytes
First seen:2020-08-03 06:59:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yMj6dU073rU/L8Sen0ZAWJ8gqadmc5qxejLiyL23SC69Xh:rjsD0z8xn2TJ8gqadPqxe3iyk2x
TLSH C6A4234D497297BA036E8512CBB0AE6B64784CB64E737C9D4833EEF298C07FE151685C
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.prosemvds.com
Sending IP: 89.107.226.195
From: info@gb-promotion.com
Subject: RE: PO 0453 New ORDER-LIST#
Attachment: New Order0770.z (contains "New Order#0770.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f152c918754d526cdfdfc80bc9bc2f07a29c464ca1920e4fbd882479758a738/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 07:01:10 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4kszemhktksntp57salzg6c6b5ctrdezimsbzh33cbepf2yu44a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f152c918754d526cdfdfc80bc9bc2f07a29c464ca1920e4fbd882479758a738

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9f152c918754d526cdfdfc80bc9bc2f07a29c464ca1920e4fbd882479758a738

(this sample)

AgentTesla

Executable exe c95e7d84353b77c81870d17df0d8a73387b3d3804b5db509b50176b049fa7a8b

  
Dropping
MD5 50143fb6a9fe72880f02c8f8c218dc85
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c95e7d84353b77c81870d17df0d8a73387b3d3804b5db509b50176b049fa7a8b

Comments