MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf5c8f7e46432ea680138ece9f231b80848dc4f0fd9ef5a90216f38a0e5de498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf5c8f7e46432ea680138ece9f231b80848dc4f0fd9ef5a90216f38a0e5de498
SHA3-384 hash: d481b78f91a3c51e32f4d469899aaab5e38a201c84905bba8a5c5404e4454590ace7b7a32f35c36c0522789a13113e3b
SHA1 hash: b09618a86d159c952e9fb720a30339bec316051c
MD5 hash: b8126c209bcb88f7c7c74a3d0e3074b0
humanhash: november-white-alanine-fanta
File name:Payment Advice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'953 bytes
First seen:2020-07-14 06:04:19 UTC
Last seen:2020-07-16 05:15:02 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:mCaf0QpR912qn2EJFCsrmHyfT2B3kwd39vbGeo6:dapRZpFCsT2SetjGe1
TLSH 19A42388B08F015ECF4DB4167BD2D9C1179AF46207CA922EAB20E59495FBF49D1FE434
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: Sabine Duval <Sabine@holstongases.com>
Received: from holstongases.com (unknown [195.184.79.126])
Date: 16 Jul 2020 02:49:15 +0500
Subject: Payment Advice
Attachment: Payment Advice.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.13070.25735.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20774.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf5c8f7e46432ea680138ece9f231b80848dc4f0fd9ef5a90216f38a0e5de498/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-14 00:28:13 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5oi67sgimxknaatr3hj6iy3qcci3rhq7wpplkicc3zyuds54sma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip bf5c8f7e46432ea680138ece9f231b80848dc4f0fd9ef5a90216f38a0e5de498

(this sample)

AgentTesla

Executable exe 930d653a60d5eea45cb332a3b313d8bf129c1b6a0dfa82aaedadfb9dd0dc8ced

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 930d653a60d5eea45cb332a3b313d8bf129c1b6a0dfa82aaedadfb9dd0dc8ced
  
Dropping
AgentTesla

Comments