MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9e0a5bede686c61439c1a0564198b89c82e10d4a37732d6afe008ee71468ced. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9e0a5bede686c61439c1a0564198b89c82e10d4a37732d6afe008ee71468ced
SHA3-384 hash: 0dd1fe81e6a1bb104729f78d65c91aa2963ecc5dfbe4b7e476792d77219f3078258940c3e0add5c0d1ae20dc91a7bf51
SHA1 hash: c8d1586940025db3c70b3cf8742168f547cbc725
MD5 hash: 845e6abddbeaac76eb8ddc82dbbfbbb1
humanhash: network-salami-batman-zulu
File name:SOA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:663'181 bytes
First seen:2021-01-11 08:53:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:IyxV0rN32/plkyvZCfJ8fSY+rAhmD34uUSHk9ykEdTKjveNaz9v+1ThKImMKX:IyxV0d2/odGSY+MSIuUMSQdevt+REMKX
TLSH 94E433393DA5133E9721B92E9642EF47014811388F7BB9976581BEF30542F2DC4356FA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.sahafnraz.com
Sending IP: 69.64.86.161
From: Sales Department <admin@gulfholidays.net>
Subject: ESTADO DE CUENTA A LA FECHA
Attachment: SOA.zip (contains "SOA.exe")

AgentTesla SMTP exfil server:
mail.chestronic.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1292.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9e0a5bede686c61439c1a0564198b89c82e10d4a37732d6afe008ee71468ced/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 08:53:07 UTC
AV detection:
5 of 44 (11.36%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3hqklpw6nbwgcq44dicwigmlrhec4eguun3tfvvp4aeo44kgrtwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9e0a5bede686c61439c1a0564198b89c82e10d4a37732d6afe008ee71468ced

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d9e0a5bede686c61439c1a0564198b89c82e10d4a37732d6afe008ee71468ced

(this sample)

AgentTesla

Executable exe 054d100afdadfa10c55b97562d697358e8189b4d9414403626a480a7d4474c96

  
Dropping
MD5 9f34677ce868131a3d7e16160945a39e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 054d100afdadfa10c55b97562d697358e8189b4d9414403626a480a7d4474c96

Comments