MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c04dc5dd7911fd254fc4fd57f9a85e1b56581e0274f331638145d9d72d2dc146. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c04dc5dd7911fd254fc4fd57f9a85e1b56581e0274f331638145d9d72d2dc146
SHA3-384 hash: 29cb9a9e0f7c279fe871d9f2175082c741b90ae3cf5eb4fa3d93d8da6fa45c6abfdc085f830bb478cb5eeb3aca749551
SHA1 hash: 12c5acaf265af29b3114ddf595c4b4e3cf935b89
MD5 hash: 6bc13b5485bec7a02d643d9b79b606eb
humanhash: charlie-double-sink-fourteen
File name:BANK COPY.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'252 bytes
First seen:2020-07-28 15:54:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:J+AXwqqB5iE1Plg4ZTsL0t+T7ztRXRbGKPeOq+lI:cAXwTiE1tgJLaKHnXRxeOq0I
TLSH 03A423E653B41D3A728497CCC24BB47AC2D86E4B5362F46F0B31AECE50A1447DDCE859
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: chase-server.Chase-Durer.local
Sending IP: 76.79.243.86
From: Nick Lee<bsenturk@larmetex.com>
Reply-To: <bsenturk@larmetex.com>
Subject: Bank copy of Payment
Attachment: BANK COPY.rar (contains "BANK COPY.exe")

AgentTesla SMTP exfil server:
mail.pushpageseo.com:587

AgentTesla SMTP exfil email address:
test@pushpageseo.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c04dc5dd7911fd254fc4fd57f9a85e1b56581e0274f331638145d9d72d2dc146/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 15:56:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ybg4lxlzch6skt6e7vl7tkc6dnlfqhqcotztcy4bixm5oljnyfda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/c04dc5dd7911fd254fc4fd57f9a85e1b56581e0274f331638145d9d72d2dc146

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c04dc5dd7911fd254fc4fd57f9a85e1b56581e0274f331638145d9d72d2dc146

(this sample)

AgentTesla

Executable exe 3dd701e877f0f802984c90bcfdcde54c35780c9afb459b2d395e6d38b2d4a503

  
Dropping
MD5 937717f0eb3d33bab9f444e54e6040b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3dd701e877f0f802984c90bcfdcde54c35780c9afb459b2d395e6d38b2d4a503

Comments