MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba71e5a93fad3b64753bb786072ddf5d9e4513e7cd5bd94fa66fca6d8b270f62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba71e5a93fad3b64753bb786072ddf5d9e4513e7cd5bd94fa66fca6d8b270f62
SHA3-384 hash: b7c8bdc0d456afadbc26509a579eb81efd145a605e6db8a714e0c0a06fbfb42be6acc0fecd56b7c63257ebda75bb5145
SHA1 hash: 1fecb3fad31a8c38ac3d4b66586dc9e345fcbae4
MD5 hash: d85f964b87fb2ea8c59d335367632f73
humanhash: florida-sweet-dakota-pip
File name:payment details.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:603'808 bytes
First seen:2020-08-10 09:49:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PP66zhFdngIcRNbKkDGFdYk/TA/Pk7Nu3OTn7atZn4lleCmiTgWRXy+Gr9bs:nThbHcKu8r/snk783g7avj+gqi+Ge
TLSH 50D4238C2DC039BCCD0B448B071B6FE9E484DD62A5F167DACB75901B56C7E28A38D199
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qtechglobal.com
Sending IP: 103.99.1.172
From: "peiqin.cao"<peiqin.cao@qtechglobal.com>
Attachment: payment details.rar (contains "payment details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba71e5a93fad3b64753bb786072ddf5d9e4513e7cd5bd94fa66fca6d8b270f62/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 09:51:13 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjy6lkj7vu5wi5j3w6daolo7lwpeke7hzvn5st5gn7fg3czhb5ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ba71e5a93fad3b64753bb786072ddf5d9e4513e7cd5bd94fa66fca6d8b270f62

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ba71e5a93fad3b64753bb786072ddf5d9e4513e7cd5bd94fa66fca6d8b270f62

(this sample)

AgentTesla

Executable exe a7118b5327e01dc08fae4ab228e1ae2920dde4df42232fa8062eaf90066b3f7d

  
Dropping
MD5 d4d2f911ce6330572ed9b6045bd7142d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7118b5327e01dc08fae4ab228e1ae2920dde4df42232fa8062eaf90066b3f7d

Comments