MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d52d4759e491952aa99de29749a964bf4249a5cf9fd5788daa7fea92bae69063. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d52d4759e491952aa99de29749a964bf4249a5cf9fd5788daa7fea92bae69063
SHA3-384 hash: 03532ca2aea79f6bb3c7a6ec00cfcdecd296a8f57846aa4e7e1e2874f308b074f0ef6c983f5a333fbdec5d454624d8fe
SHA1 hash: d4242ca59091cb6265cadc108c67e9840b2164cb
MD5 hash: f1b07cbe8901bbc257fb88761876aa34
humanhash: connecticut-lion-thirteen-alanine
File name:PRO INVOICE.gz.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'845 bytes
First seen:2020-06-18 05:50:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:eWH9tJkUQV3I0K6JHGy3r62mgnJ3hiYTK:VHCPdI9XFgnJ3AYW
TLSH 6084230D2101A8F370B9BFB41469E1398CA96B69B0B06B35139ECF276F231C76133B56
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: "contact" <sales@resourcedm.com>
Received: from resourcedm.com (unknown [185.222.58.143])
Date: 17 Jun 2020 22:47:03 -0700
Subject: Re:PROFORMA INVOICE
Attachment: PRO INVOICE.gz.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 04:24:14 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uwuowpesgksvkm54klutklex5betjopt7kxrdnkp7vjfoxgsbrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d52d4759e491952aa99de29749a964bf4249a5cf9fd5788daa7fea92bae69063

(this sample)

AgentTesla

Executable exe 313fc2bc689fcc4d9d0b191fa6107cf29dd9f56aba4b3ef2ad0b02e6a7596bf4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 313fc2bc689fcc4d9d0b191fa6107cf29dd9f56aba4b3ef2ad0b02e6a7596bf4
  
Dropping
AgentTesla

Comments