MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c855d36fd2b0a5ba2e23cab187ebe619c41b279919865beafaa34fd85e068b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c855d36fd2b0a5ba2e23cab187ebe619c41b279919865beafaa34fd85e068b5
SHA3-384 hash: 18d48e663793f2906bc10efe4e48303ec73fb359bb494fafb5a127e450845020de5f00e4d93ce90e071ce51e43c3d254
SHA1 hash: 8774a2ad3b42898e475e8a525bc30638e344805f
MD5 hash: b03a0c84949267b20e2a706c6f3168e3
humanhash: lake-jupiter-shade-lactose
File name:INVOICE.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:461'436 bytes
First seen:2020-05-12 05:33:27 UTC
Last seen:2020-05-12 09:44:23 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:B+nEcXV2cVTvspNbkL6vcdl69C5MObp3Le:4Ecw0vspOWvci9C5MOtLe
TLSH F5A423F459827BBD0E463050970EB027EEC7ABE9C5C9CA7087324985279FE9425DCEA0
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 95.211.208.58
From: 上海金鼓 : Accounts Department Assistant <rud-division@alkuhaimi.com>
Subject: FWD: Re: 答复 paid invoice
Attachment: INVOICE.pdf.z (contains "INVOICE.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 05:36:06 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dscv2nx5fmffxixchsvrq7v6mgoedmtzsgmglpvpvi2p3bpanc2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 1c855d36fd2b0a5ba2e23cab187ebe619c41b279919865beafaa34fd85e068b5

(this sample)

AgentTesla

Executable exe 312de3802dada78c710b868a26d744dc65991de475bc741c21c5714a84977813

  
Dropping
MD5 82c4801ed670e3a614008eda7d6950c0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 312de3802dada78c710b868a26d744dc65991de475bc741c21c5714a84977813

Comments