MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcd5733309a362f3f8dee865c51329af843ab26787674f4dd922219023c215c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bcd5733309a362f3f8dee865c51329af843ab26787674f4dd922219023c215c5
SHA3-384 hash: a633af2cc14dc9aefefc640a7dab928ed8b7acb3b9bce98bed8965c56f8ddeeb40065251e02d98c478644bd570fb962f
SHA1 hash: a8bd515678e7cdc44884dab4a1afc784360067f7
MD5 hash: e6fe04734299d7f85ea78276811ed765
humanhash: batman-xray-michigan-lithium
File name:Transfer Forms.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'382 bytes
First seen:2020-08-17 08:58:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:7GZma9DTFmajOvGlzOEgrqWmXH9YeGXQMX1KO4WJikmTCZhTzn5r87v2cqd2pL2a:74mCFlLazqlXHMAs3HYq5I7+gt2fOR
TLSH 30942319E5D85B85E16F1FD98038E0E3A97D35E3BF98468B07CA46D3C8E85F9C007222
Reporter abuse_ch
Tags:AgentTesla Endurance rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: PAY-U <enquiry@oxy99.in>
Reply-To: PAY-U <enquiry@oxy99.in>
Subject: INCORRECT BANK DETAILS FOR PAYMENT
Attachment: Transfer Forms.rar (contains "Transfer Forms.pdf")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bcd5733309a362f3f8dee865c51329af843ab26787674f4dd922219023c215c5/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 08:59:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xtkxgmyjunrph6g65bs4kezjv6cdvmthq5tu6tozeiqzai6ccxcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bcd5733309a362f3f8dee865c51329af843ab26787674f4dd922219023c215c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bcd5733309a362f3f8dee865c51329af843ab26787674f4dd922219023c215c5

(this sample)

AgentTesla

Executable exe 825e2003550d60067503c5f26a7d1520908c0149f707cb8b63869a34fdbe967b

  
Dropping
MD5 25184c61c7676763ccdea37a668f9b9e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 825e2003550d60067503c5f26a7d1520908c0149f707cb8b63869a34fdbe967b

Comments