MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee9c512d91bf22099ef0efe7e667e8e1568897bbfce9d61fbcc111308db9746a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee9c512d91bf22099ef0efe7e667e8e1568897bbfce9d61fbcc111308db9746a
SHA3-384 hash: 8f53f029a462d3a7624b3c8ac8d9f264e79edcaef0d8bab64a30a6b54a6b96c936701b68e2bd90b741d910e957ed1e17
SHA1 hash: 8bff381ea4c4ddafb50be4d54ddd65d05c8fbe5d
MD5 hash: 6da5564bab49280d9b5ad7fba28479e6
humanhash: asparagus-video-cup-lamp
File name:1035 Purchase Contract.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:572'646 bytes
First seen:2021-03-10 16:33:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:jReL/ndOYUPXIoBYRUfHBLUeI2P2PU10ZnjrZC1jur9ivV2YjW6fOg8:QHcFY4Hm0CU10Znj12rUYjW6fg
TLSH 43C423D12119230FC4074E7FA82E09567D2DFB72E227F367F87DA55009A2256C8EDCA5
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "S.T AGENCIES <info.stagencies@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [104.223.76.182]) "
Date: "10 Mar 2021 13:45:20 +0100"
Subject: "PURCHASE CONTRACT"
Attachment: "1035 Purchase Contract.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 13:06:51 UTC
File Type:
Binary (Archive)
Extracted files:
71
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=52ofclmrx4rathxq57t6mz7i4flirf537tu5mh54yeitbdnzorva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/ee9c512d91bf22099ef0efe7e667e8e1568897bbfce9d61fbcc111308db9746a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ee9c512d91bf22099ef0efe7e667e8e1568897bbfce9d61fbcc111308db9746a

(this sample)

AgentTesla

Executable exe 5b038d7385cf7cfa9aac553b025a1b686c90a9f692a7ad78d817e56aaf5ed935

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b038d7385cf7cfa9aac553b025a1b686c90a9f692a7ad78d817e56aaf5ed935
  
Dropping
AgentTesla

Comments