MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c78a391a73d851dcabec174e72d6d8e01da04d28f343147480ef4e06b1668249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c78a391a73d851dcabec174e72d6d8e01da04d28f343147480ef4e06b1668249
SHA3-384 hash: 5ecf4f53fc70d065b400c84d1975e50a3498ce7427cf81adaa5611c928584bd012de02666f567dec9ef45373256ce2ee
SHA1 hash: 7e1755638e53235720931a4c614b7239df0dd677
MD5 hash: 0af604836b1c71df152ee1412529cd19
humanhash: fix-mango-arizona-eight
File name:INVOICE83647263.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'454 bytes
First seen:2020-04-29 18:26:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:zs/gaWMcq+URgwVRUJFnaYO1yIXzq2ax91+cBw3YkvlqXfJROw26X:w/gaW/q+URgt7n2rq/91+cycvJ86X
TLSH 68842379AF72AFB2EA25269616571A53083339B0A5D4D99FF812710EFCC57CA834C1F0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpanel2.cityonlinebd.net
Sending IP: 113.212.108.130
From: Merel Verbeek <Merel.Verbeek@medair.org>
Reply-To: Merel.Verbeek@medair.org
Subject: INVOICE83647263
Attachment: INVOICE83647263.rar (contains "INVOICE83647263.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587 (208.91.199.224)

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 08:54:23 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6fdsgtt3bi5zk7mc5hhfvwy4ao2atji6nbri5ea55hanmlgqjeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c78a391a73d851dcabec174e72d6d8e01da04d28f343147480ef4e06b1668249

(this sample)

AgentTesla

Executable exe d9568ff73274781296415519aa548621099b45cc19d68c2d9ce59ce9bee384a7

  
Dropping
MD5 8772483bfe0989dffc3f0223cd383959
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9568ff73274781296415519aa548621099b45cc19d68c2d9ce59ce9bee384a7

Comments