MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fad692f42cbfd7ceb5895f9c5ee50913c63b21b44e7b27a739836f4984f4ca6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fad692f42cbfd7ceb5895f9c5ee50913c63b21b44e7b27a739836f4984f4ca6
SHA3-384 hash: 072ba307b08b7a46af57975cbbd3a04c518b99a10f179a8d879fb164835355a6dadc36c229218ac7d34504710dffe5be
SHA1 hash: 51e61b8074be2d33dd27006a01a51a0e4463e562
MD5 hash: 8872df1726c8b9944c2c74ca8634626e
humanhash: london-double-nitrogen-berlin
File name:AD1-2001028L.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:639'763 bytes
First seen:2020-08-28 06:36:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:PZhPhZBbDIvvzbFSe/PiJU0ksGK1rTI1jkiAhKOLFxjctUdKV:xhPhnbcXzxSwPWzDrTI7OQydK
TLSH 82D423FD4A4A1F1DCACD8EE03ACB645193F28D246B10C90205BB1EB75D4529D4FEB8A7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hosting1.beeline.am
Sending IP: 212.73.86.34
From: Connie Yuan <sales9@ceaworld.com>
Subject: RE: 回覆: 固件: Re: Re: Re: Re: AW: 回覆: 回覆: invoice For shipment
Attachment: AD1-2001028L.zip (contains "AD1-2001028L.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9fad692f42cbfd7ceb5895f9c5ee50913c63b21b44e7b27a739836f4984f4ca6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 06:21:20 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6wwsl2czp6xz22ysx44l3sqse6ghmq3itt3e6ttta3pjgcpjsta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/9fad692f42cbfd7ceb5895f9c5ee50913c63b21b44e7b27a739836f4984f4ca6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9fad692f42cbfd7ceb5895f9c5ee50913c63b21b44e7b27a739836f4984f4ca6

(this sample)

AgentTesla

Executable exe a023a321ec46a48bd33ea0823b3c57b43ad09a85c711d319d556c8a5d7058b73

  
Dropping
MD5 5995b3826647d70fa0f91289eec18cd2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a023a321ec46a48bd33ea0823b3c57b43ad09a85c711d319d556c8a5d7058b73

Comments