MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9db884caac1922f00afd512ecb4af861d5e1df4fbdd1bca48a1606178769739. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9db884caac1922f00afd512ecb4af861d5e1df4fbdd1bca48a1606178769739
SHA3-384 hash: 9ff8cd0dd4bfeedfdec27663ae3074c7d4866d764426cbc806b0c2962f1c2edfebce18285ab93cb2bcd802e7b5911fb7
SHA1 hash: 260a19ca21662b3c32c797e9d6f5def1cd056b47
MD5 hash: cf0b403131fb2f739bdf135f58131ee3
humanhash: bacon-bluebird-high-fix
File name:SOA.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'964'701 bytes
First seen:2020-10-24 06:34:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:x+KE224g/Ac3V+aCWarxJvRHmkxpMJDqH/7VBPVU693JwU+M9t8aKg6suG86lzlL:obyKAc3n+hH5pMWx393/3A1gj0u4bux
TLSH 290633F1E8B56AF33F44C6194DAB0AB1218719F4B66D6112AF73B7C0AD037E2D5189B0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: stock.ovh
Sending IP: 51.178.87.221
From: qiuxu <x.qiu@rotodecor-china.cn>
Subject: RE: SOA JUN-OCT. 2020
Attachment: SOA.rar (contains "SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9db884caac1922f00afd512ecb4af861d5e1df4fbdd1bca48a1606178769739/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 18:40:08 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3hnyqtfkygjc6afp2ujoznfpqyov4hpu7porxssiufqgc6dws44q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d9db884caac1922f00afd512ecb4af861d5e1df4fbdd1bca48a1606178769739

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d9db884caac1922f00afd512ecb4af861d5e1df4fbdd1bca48a1606178769739

(this sample)

AgentTesla

Executable exe 36aa5f316ccbdec9f0945c33c142563d4bee16b3cab1bd8f17cea4d30594cf0d

  
Dropping
MD5 4efd01c55f26961a557d97829061d09d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36aa5f316ccbdec9f0945c33c142563d4bee16b3cab1bd8f17cea4d30594cf0d

Comments