MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9b43dd9381cd1dcf073df093a14aaf85a1be1d33ed7f1c7acb18052ee9b742a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9b43dd9381cd1dcf073df093a14aaf85a1be1d33ed7f1c7acb18052ee9b742a
SHA3-384 hash: 7b0642e3b7bc5a7b958095887c33ac2c33ae0bc5393d3c52eaf319df6f547ef1cb2f8bdfdc0d7effe76c3001c63e9a7b
SHA1 hash: 2b149c3f83de5625e420e0094a8250cb0df63591
MD5 hash: 9099e46ef093bf2ea80343c8d8912da9
humanhash: spaghetti-cold-paris-two
File name:HIPV0259 1X40HQ 下单表.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2021-10-06 09:13:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:aahTQ+3HwOobSVXNGAQpB+64+8sdIUyJ3ET2p4u07Tw67F4bX8s8jX+JdbViyLag:ioohhT4OvQSu07TwS8sbjQd0aasf5x
TLSH T11045E054632B8B4ECD3887F56810A2114BF6952F206AC7747ECDA0ED2B57FB05AE0D93
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Eva Shen <merlighting@mlmfurniture.com>" (likely spoofed)
Received: "from mlmfurniture.com (unknown [185.222.58.155]) "
Date: "6 Oct 2021 11:08:54 +0200"
Subject: "=?UTF-8?B?UmU6IFJlOiBSRSBISVBWMDI1OSAxWDQwSFEg5LiL5Y2V6KGo?="
Attachment: "HIPV0259 1X40HQ 下单表.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615d68da98a6280f3932d119/reports/3a697cb9-9545-4b14-b425-41e4cd34cc32/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9b43dd9381cd1dcf073df093a14aaf85a1be1d33ed7f1c7acb18052ee9b742a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-06 09:14:06 UTC
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vg2d3wjydti5z4dt34etuffk7bnbxyoth3l7dr5mwgaff3u3oqva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9b43dd9381cd1dcf073df093a14aaf85a1be1d33ed7f1c7acb18052ee9b742a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img a9b43dd9381cd1dcf073df093a14aaf85a1be1d33ed7f1c7acb18052ee9b742a

(this sample)

AgentTesla

Executable exe 34ca9a1b6fd8f866a4209606109611b0d3d095c956033fa2869a1cfc6ba760bf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34ca9a1b6fd8f866a4209606109611b0d3d095c956033fa2869a1cfc6ba760bf
  
Dropping
AgentTesla

Comments