MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 291b0c5cc902d391a4c9c9aa5f516c540be563190476499f98a97004c4810ec5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 291b0c5cc902d391a4c9c9aa5f516c540be563190476499f98a97004c4810ec5
SHA3-384 hash: 89ccb3de176989e1496dc802766f0350ddeafdff6d9481611336ec9a37a7fcf5672a4e4b3176cd3c25cf3eb1ffa8eb9e
SHA1 hash: 17ae2a5dd7d0a79102476a6f2f714a9766973369
MD5 hash: cc46514f29105e008491a95c2b7e69e1
humanhash: venus-east-december-snake
File name:Signed Invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:941'567 bytes
First seen:2020-05-27 11:35:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:IyDNptcPZ9/JMxptgHx0FqP+R5ChfiXqUQvjv7EG9Lo+pbVXU5GOitf4E:PNuZJJUK0hXqUIh6+pbVXwWtf4E
TLSH B4153310775D8522B969047A8F39EFDDD81C23AA367F604BE885E480872166F07D2FF9
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:34:13 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 291b0c5cc902d391a4c9c9aa5f516c540be563190476499f98a97004c4810ec5

(this sample)

AgentTesla

Executable exe 324871c93edf7dee76662a7a3da9bc2a0d8814a25de8c1b9d812449f6cbb3824

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 324871c93edf7dee76662a7a3da9bc2a0d8814a25de8c1b9d812449f6cbb3824
  
Dropping
MD5 76ed058d165c39a636a2b87f5e32967b

Comments