MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78754a57a06bd7b5f2eaa2fbee3ef6ccfcf04dfc1500f9c1dff4f115f67c2929. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78754a57a06bd7b5f2eaa2fbee3ef6ccfcf04dfc1500f9c1dff4f115f67c2929
SHA3-384 hash: 57ca212602a1a159673cb91795bdddaba9dc4ad400d6eebea7e86cc47cb2ad1316d430fddbb7041e00dc08dd05ba9e2d
SHA1 hash: 905e7ccb46184a56380952584cdf9cfd7b717c16
MD5 hash: 563c2430d43ea79f03f55b0c5945a4ff
humanhash: river-papa-mockingbird-finch
File name:overdue invoice.pdf...zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:369'135 bytes
First seen:2020-07-16 08:22:22 UTC
Last seen:2020-07-18 02:51:00 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:RkiYIa8GPWEL+BWny7wQzSxLKNhmxkmJqNQDpmehZXf/vscQ0zISZ25sAYA3PPv4:Sua8GiBWy7wQzSxLFeQDIYXf/vsSzIz+
TLSH 1B74236E959E089715F1E362D22FA0B26C3CA4D3F1D062B7AFC625D2FD1B13BC854A11
Reporter abuse_ch
Tags:AgentTesla DBS zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dbs.com.sg
Sending IP: 103.99.1.159
From: DBS Bank<info@dbs.com.sg>
Subject: TT- Swift Copy: 471/35/13A-2773 From DBS Bank
Attachment: overdue invoice.pdf...zip (contains "overdue invoice.pdf...exe")

AgentTesla SMTP exfil server:
mail.matrixas.in:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.393.3500.9507.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78754a57a06bd7b5f2eaa2fbee3ef6ccfcf04dfc1500f9c1dff4f115f67c2929/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 08:24:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pb2uuv5anpl3l4xkul564pxwzt6patp4cuaptqo76tyrl5t4feuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 78754a57a06bd7b5f2eaa2fbee3ef6ccfcf04dfc1500f9c1dff4f115f67c2929

(this sample)

AgentTesla

Executable exe 93c807a2fb8dff5a30d9f860f1eb98304d8303f8fff4c53c98870201d6d3eb68

  
Dropping
MD5 fa0c9ce3695691566ec8fbba088433c6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 93c807a2fb8dff5a30d9f860f1eb98304d8303f8fff4c53c98870201d6d3eb68

Comments