MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5c7de4faf863c60a237e9649fe94716e7ebaba5bc896a883d4b36f5389eb528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5c7de4faf863c60a237e9649fe94716e7ebaba5bc896a883d4b36f5389eb528
SHA3-384 hash: ab2c5e50f84270e28cc1da207bc298763effaf50f6ec202d0a46a7ed441aed8dc4103e6aefd4e958332cd644c6f120d2
SHA1 hash: 282f76418460fb41deb607f947210a8a85d85c66
MD5 hash: 9510f4fd6ccd3fa7f8cec6f4ec271502
humanhash: single-enemy-stream-missouri
File name:Factura.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'111'008 bytes
First seen:2020-04-30 07:50:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:WK+ca+cKWyOCn30maY0q7bNbR1Qa2ZeAQCROcPVtDdP/jw:WKtal9yOw0M3P1f2OsO0/DdP8
TLSH 953533FDB45D6FCA7224B8AFF0E9921594B3184C27129248C5B3DBD8298BD1A5DD10CF
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ap.aphunter.live
Sending IP: 77.242.152.32
From: Sebastián Alarcón <info@solzuwebapi.live>
Subject: Rv: TRANSFERENCIA
Attachment: Factura.zip (contains "Factura.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 19:23:17 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xd54t5pqy6gbirx5fsj72khc3t6xk5fxsewvcb5jm3pkoe6wuua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e5c7de4faf863c60a237e9649fe94716e7ebaba5bc896a883d4b36f5389eb528

(this sample)

AgentTesla

Executable exe 7f806ac81a2365986c7d65f22b5459125937b184a6f13208bad4cb684bc70260

  
Dropping
MD5 a07c880b131a62a5c573fbc8becc1b06
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f806ac81a2365986c7d65f22b5459125937b184a6f13208bad4cb684bc70260

Comments