MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9cfd1c6ec2440f901e786a33478de70fd090e1e9dc9b55aedba8fce5b2a4d50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9cfd1c6ec2440f901e786a33478de70fd090e1e9dc9b55aedba8fce5b2a4d50
SHA3-384 hash: 0a2f53d62c1d5eb43b936063b4f5828cceab98d3cc7a5ebae41ab768fc7b53fffdc6f94621b98ae31246daa87f82912c
SHA1 hash: 0866f867a6db703613100013bc0aa7aa0061f766
MD5 hash: 6cc5d04f6f11b8d14e05184af6f19668
humanhash: equal-carolina-hotel-lion
File name:Thalesnano.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:291'638 bytes
First seen:2021-04-07 05:53:36 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:Z0NmXh0Ov+RpsEUIf+CcPBkCO/wOUcF06TqBn9ogJ3UU16cBLewggKTzOIs3:ZKmXh0OveGdIHkcxUYWB6cz1lqw1GOIW
TLSH A95423FE195042C2442B391D463234C641CED61156247F7325A4076EBEF2B7F4AEED6E
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.coboisa.com
Sending IP: 194.31.96.140
From: paul <account@victim-domain>
Subject: Payment for invoice no.2021.00294-02
Attachment: Thalesnano.gz (contains "Thalesnano.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.3827.11633.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9cfd1c6ec2440f901e786a33478de70fd090e1e9dc9b55aedba8fce5b2a4d50/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 05:54:12 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5hh5drxmerapsaphq2rti6g6od6qsdq6txe3kwxnxkh44wzkjvia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/e9cfd1c6ec2440f901e786a33478de70fd090e1e9dc9b55aedba8fce5b2a4d50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz e9cfd1c6ec2440f901e786a33478de70fd090e1e9dc9b55aedba8fce5b2a4d50

(this sample)

AgentTesla

Executable exe 1c20e81106455f9fb194f0eed281aaa0f48169a728f73b7b42f0d4bec7fbcc32

  
Dropping
MD5 39a5a52bd0138cb973e646915bac0303
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c20e81106455f9fb194f0eed281aaa0f48169a728f73b7b42f0d4bec7fbcc32

Comments