MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01c8e07de7c71131815461c92df3fe6f2416ab56ad65c31e69ae0e5bd47c339e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01c8e07de7c71131815461c92df3fe6f2416ab56ad65c31e69ae0e5bd47c339e
SHA3-384 hash: 7a927296eafd4305f4830d973f19f919a32c3c34bbc4a8a3dec0be4f89700637d86706734509629fb03d5cf09c77de3c
SHA1 hash: 2875c43204a9acab803a2eae5170dfdf440da16e
MD5 hash: 602c2be9915232d2fa21f3d9303122df
humanhash: glucose-delta-ten-nebraska
File name:INVOICE INVOICE DRAFT COPY_SCAN555688.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:940'346 bytes
First seen:2020-06-03 12:52:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:IdqLLNu0Ic6Na2Os9znRaxJfJX4a920m9cdyD0:IYvLTsnRKm3Q
TLSH 8E15234A9E533B2FB4FDF9F6CA0DAD88D4D676711A3BF12ADF414F8D90428388924254
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail2526.himayadar.org
Sending IP: 188.138.125.225
From: Nylene Criste <info@mail2525.himayadar.org>
Subject: INVOICE DRAFT COPY
Attachment: INVOICE INVOICE DRAFT COPY_SCAN555688.rar (contains "INVOICE INVOICE DRAFT COPY_SCAN555688.exe")

AgentTesla SMTP exfil server:

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 18:53:00 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aheoa7phy4itdakumhes3476n4sbnk2wvvs4ghtjvyhfxvd4gopa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 01c8e07de7c71131815461c92df3fe6f2416ab56ad65c31e69ae0e5bd47c339e

(this sample)

AgentTesla

Executable exe 027c5324e6066d9ffdf84ca77ea0502139d0ffdadcdb033c3adc7e3f870e835b

  
Dropping
MD5 520b0100121b401f84d7f863f0494727
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 027c5324e6066d9ffdf84ca77ea0502139d0ffdadcdb033c3adc7e3f870e835b

Comments