MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1681a105aa761696b9456466a1e411591194021a492606dc66e1647f3b0bd9e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1681a105aa761696b9456466a1e411591194021a492606dc66e1647f3b0bd9e3
SHA3-384 hash: 503c7a96244a7988b7c687e04a4f1fd6f8721e84538197c6c468d6d7a1a51873894afecc241cf6868b7ac94736d33a38
SHA1 hash: 6acd2b83bd84203370c3e87ee67a7d08796af18b
MD5 hash: 77c2a732249599d5053a8f93e6252991
humanhash: kansas-whiskey-cola-music
File name:invoice.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'469 bytes
First seen:2020-06-03 06:10:37 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:GMpB2Qui3p7fFttzzZkQA8LvNdARtB60bLeKF:GMpBThZ7fbtZZAoldeTe+
TLSH DB9423C2F8F7635166A19434ABBD34A54E31A8235E2FB4F9C788122410D5F35AAD8F72
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email
From: Accounts Department <meckor@alkuhaimi.com>
Received: from alkuhaimi.com (unknown [37.48.85.217])
Date: 3 Jun 2020 02:18:12 -0700
Subject: Fwd: [Fwd: Balance Payment]]
Attachment: invoice.pdf.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 07:42:35 UTC
File Type:
Binary (Archive)
Extracted files:
318
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c2a2cbnkoyljnokfmrtkdzarleiziaq2jetanxdg4fsh6oyl3hrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 1681a105aa761696b9456466a1e411591194021a492606dc66e1647f3b0bd9e3

(this sample)

AgentTesla

Executable exe c4749b9ab06cbcd9dc5846909e6e6965329f430899f5019c8b05cb5af879c4a8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c4749b9ab06cbcd9dc5846909e6e6965329f430899f5019c8b05cb5af879c4a8
  
Dropping
AgentTesla

Comments