MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea0cb4375c786950a9ce09d02a197759eac4f1230c858479b190f54143b6c26b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea0cb4375c786950a9ce09d02a197759eac4f1230c858479b190f54143b6c26b
SHA3-384 hash: bf84d4133877f470c409b88f565082ca9d6a393449e9e0140937957e5d3031266d44fec8978777b3cfc6dff6483abd52
SHA1 hash: 1a0975d24a5c3bd7c99a6cb9568f2acfbd8e26b4
MD5 hash: 72023ed6e9b2a96f0e201c5bb377e489
humanhash: leopard-oklahoma-mexico-sixteen
File name:Outstanding Invoices 005475-2020.pdf (2).exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:437'248 bytes
First seen:2020-07-02 05:02:55 UTC
Last seen:2020-07-02 05:34:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1d13da7bcb3a2ab493244ab9add290a5 (1 x AgentTesla)
ssdeep 12288:wika3qot108/MFjnsY6i4IcqxZofR/Zo09B62:1t28/MFj3JFCfRCg
Threatray 11'136 similar samples on MalwareBazaar
TLSH 709423362D6214E3EB501CF727968E868F53B46F4A7A27531E49F51E5E322C386D2323
Reporter cocaman
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17780/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ea0cb4375c786950a9ce09d02a197759eac4f1230c858479b190f54143b6c26b/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 01:20:55 UTC
File Type:
PE (Exe)
Extracted files:
60
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5iglin24pbuvbkoobhicuglxlhvmj4jdbscyi6nrsd2ucq5wyjvq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
0b1ce90ba8d64281d16d29dac2cd146e81d18359c572cfd92840dfffbcd0f713
AgentTesla
16fd6da285b47443d75cd87eff0cd554c7cfc747488d4e79e2a78033af2709ee
AgentTesla
301e1fa5855704be7f2c773cb7393098c89fe31b40dc6237420835d1c53a6a64
AgentTesla
33fefd2ae3ff75bcae6718f2abbc99bc7ca047a4543c5420883eb39e1128e9e5
AgentTesla
3a07439a1a99adf36ee223fd32595574e6c7803bd380c573a2448be340d50c19
AgentTesla
a431aa89dd427e5145ec7bc7a4b6509edd49b34c0ffc2f966bf51889f0a34e92
AgentTesla
b35a31d0e1bf728b423db895fa10a083ddaf0e745e81e945dfac043a347fe6e7
AgentTesla
bb959cf2808c00dbce35074844165d736f50f2b0ca81ac56b7818dc7d60c5dd0
AgentTesla
d146eb20c0c3745f4e74267f468a4fc870c1639b48bdd634d10f82856e7b59e9
AgentTesla
e8832bdaa159f1e5a0f7e4ce323c8a302c0db9cd7eb6ba0434fee843d7333129
AgentTesla
+ 11'126 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200702-9bt3q7ml4e/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 23e18199dcc419d4ed9dbf113cb295e6b81efa637718532bcae10737bad6b94b

AgentTesla

Executable exe ea0cb4375c786950a9ce09d02a197759eac4f1230c858479b190f54143b6c26b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 23e18199dcc419d4ed9dbf113cb295e6b81efa637718532bcae10737bad6b94b
Cape
Cape
https://www.capesandbox.com/analysis/17780/

Comments