MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f78913a0a4ea67a4e76f5b8deccbbde69d21352e14307fbefa2db94305e4c3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f78913a0a4ea67a4e76f5b8deccbbde69d21352e14307fbefa2db94305e4c3d
SHA3-384 hash: b72a9067e5dfedb109036c536a14b3b542022c560268c20a61d9a9f881dfec65c28f595a089b196843d2ba073219ea95
SHA1 hash: 44db85bbac13420a4f27dc0c248da14edfb202a1
MD5 hash: 594aed64f6c0101b9204522eb0f0a2bc
humanhash: berlin-alanine-one-butter
File name:BANK DETAIL WITH STAMP 84,867.06.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:625'344 bytes
First seen:2020-08-04 10:57:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:p363teLFW7XjP+GUYg49Zk64lJvea8bAAyQHzd+L6KAL8aTGR8c11IbOyGpZyyNs:p363E2PhR5nI38LZTA6c11IJGf938
TLSH 1AD423948DB64F3B96FBCA1400627E22AF724F3CECCCD54A3519743693B684E924BD58
Reporter abuse_ch
Tags:AgentTesla r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: froech-gmbh.com
Sending IP: 185.222.57.207
From: Froech GmbH <office@froech-gmbh.com>
Subject: EMAILMING BANK PAPER PAYMENT OF USD 84,867.06
Attachment: BANK DETAIL WITH STAMP 84,867.06.r11 (contains "BANK DETAIL WITH STAMP 84,867.06.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f78913a0a4ea67a4e76f5b8deccbbde69d21352e14307fbefa2db94305e4c3d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:57:00 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l54jcoqkj2thuttw6w4n5tf33zu5ee2s4fbqp67pulnzimc6jq6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5f78913a0a4ea67a4e76f5b8deccbbde69d21352e14307fbefa2db94305e4c3d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5f78913a0a4ea67a4e76f5b8deccbbde69d21352e14307fbefa2db94305e4c3d

(this sample)

AgentTesla

Executable exe e7cd9d6b370e89f736e5819565f9fabc8cddad256514e75672274ae11609dcb5

  
Dropping
MD5 e244b1c560a9bf79632da6050eba120d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7cd9d6b370e89f736e5819565f9fabc8cddad256514e75672274ae11609dcb5

Comments