MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dc4ae8903048391287d13deae6b69b7128380df0dadebadc0e376e34b124fb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5dc4ae8903048391287d13deae6b69b7128380df0dadebadc0e376e34b124fb1
SHA3-384 hash: 9ef5c6d629cc3cd33f5ab80af771d9163b7f673799ed608db27557f9a785fabb7ef63447f322032e511106bf43eeb3bd
SHA1 hash: 7719991506a54e7b9c3c058ebd068bc403c2b772
MD5 hash: 097c4614d8fdf22f294a8c8bc5aa9f83
humanhash: papa-march-cola-bakerloo
File name:Payment.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'050'633 bytes
First seen:2020-04-30 08:10:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:QSvcWFfg87BaR+eKGf+rjY5JDsBA33YCnqFaCMKWRSq:NxFfH7BaR+gf+rjqQeHqFaCMnIq
TLSH 892533619D7308F8BFE5535EA2C0441DC229DC9B4CB28A98BF2C9676C4D6E5C9C0E7E0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zebra.vivawebhost.com
Sending IP: 78.128.60.93
From: ACCOUNT DEPARTMENT <kate@advendashersafaris.co.ke>
Subject: SWIFT Transfer TODAY
Attachment: Payment.rar (contains "Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Script-AutoIt.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 08:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxck5cidasbzckd5cppk423jw4jihag7bww6xloa4n3ogsysj6yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5dc4ae8903048391287d13deae6b69b7128380df0dadebadc0e376e34b124fb1

(this sample)

AgentTesla

Executable exe 1918d9a9d0d4d4fd0c3792816e0c1cf5e78f86697bc529e33a6e471e7b20a7b4

  
Dropping
MD5 108ddd8c7338aaecbcc33c3417d2dce0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1918d9a9d0d4d4fd0c3792816e0c1cf5e78f86697bc529e33a6e471e7b20a7b4

Comments