MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baf9f9eb2e8ac395d6db95a527919db8452c70fbddd27e0c976dd2fe7c1cf8bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: baf9f9eb2e8ac395d6db95a527919db8452c70fbddd27e0c976dd2fe7c1cf8bf
SHA3-384 hash: f21f9833b370de5ebcd6b1dca5356bc8ba34a4f3762963d5fbab2ef1f05d64e5e24ed0c8a8c06fc4941f6b06a98cdb7d
SHA1 hash: 2d629eb022c5863244733cdba264e9fe1d66228e
MD5 hash: 8a7742c4b36ea31d9163fe6979435285
humanhash: oklahoma-pennsylvania-november-washington
File name:BALANCE PAYMENT.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'590 bytes
First seen:2020-11-11 10:21:03 UTC
Last seen:2020-11-13 02:53:36 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:dwn2jVOcyMMg6SIhSymufMryxPYDqY9jw7U4cUhoG53rznpHm+Z5WHr5bSrab:HyYKS5ufM+wDqSr1KoG9pG+Z5y9bkab
TLSH 848423B6B135ADB17C5990E0F54F4C385064841BABE03AA36D774EAC4E793E0A1CF1A6
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Accounts<cady@cnyouna.com>" (likely spoofed)
Received: "from cnyouna.com (unknown [62.113.215.212]) "
Date: "12 Nov 2020 08:13:13 +0100"
Subject: "DID YOU GET THIS PAYMENT????"
Attachment: "BALANCE PAYMENT.Z"

Intelligence

File Origin
# of uploads :
9
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/baf9f9eb2e8ac395d6db95a527919db8452c70fbddd27e0c976dd2fe7c1cf8bf/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 09:32:51 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xl47t2zorlbzlvw3swsspem5xbcsy4h33xjh4dexnxjp47a47c7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z baf9f9eb2e8ac395d6db95a527919db8452c70fbddd27e0c976dd2fe7c1cf8bf

(this sample)

AgentTesla

Executable exe 395aadc58bde92d29449ba1d349f39e73205f9e2794cbbbd397f85796c91de77

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 395aadc58bde92d29449ba1d349f39e73205f9e2794cbbbd397f85796c91de77
  
Dropping
AgentTesla

Comments