MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fd2d0ed7c2c96fef650c30d0c695115ecceec883de78daaf3777dc9c6505613. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fd2d0ed7c2c96fef650c30d0c695115ecceec883de78daaf3777dc9c6505613
SHA3-384 hash: c230053a9998424800ecd3917ef3e2ecc89e9f806ad4602dc04263595ac5a7667eaac74410a571a56d5b514d2749ea54
SHA1 hash: 34c27322e2e10d5d0c4197709ee68072091da548
MD5 hash: 2a535e7ade62fb00715c9f6d88200d67
humanhash: fix-floor-robin-twenty
File name:Scan docs.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'468 bytes
First seen:2020-06-06 07:05:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:huab29Jdofsxv4y7R6xXiHdZxSMNOg1gIZMu/avaTKBn:F294Uxv4yQSHd7BOgNMu/VTm
TLSH 349423B9CBDE6F3AC5DD962D563E48167A0BAB55B53AC081E0C8E7CC74C070241D6BE4
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: digamma.host-in-europe.com
Sending IP: 62.75.189.83
From: kudinova@otis.kz
Subject: Payment Sent T/T Receipt Attached - Overdue Invoices Payment
Attachment: Scan docs.rar (contains "Scan docs.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 07:07:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7jnb3l4fslp55sqymgqy2krcxwm53eihxty3kxto564trsqkyjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9fd2d0ed7c2c96fef650c30d0c695115ecceec883de78daaf3777dc9c6505613

(this sample)

AgentTesla

Executable exe acfc26326f526d83c1fa3004df2cacec7decdb74024d645553ab1ec7a9d27c98

  
Dropping
MD5 6375a1ad18819007435ff4e7526470bf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 acfc26326f526d83c1fa3004df2cacec7decdb74024d645553ab1ec7a9d27c98

Comments