MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25fe24fc98f5d8bb89c0dba2a703123f848eeb7bc35c48bc557ca78122838b60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25fe24fc98f5d8bb89c0dba2a703123f848eeb7bc35c48bc557ca78122838b60
SHA3-384 hash: 2f836359834401c88269c351a44ceb643a7a40d9929ea30e00bca9c0a9860ffde4839ed9079a8b1b81b60b77a6666281
SHA1 hash: 574f2dc446a834a254292837cfb18192796264f8
MD5 hash: 0768683a55d17770632299a9b25e7b04
humanhash: august-river-washington-finch
File name:proforma invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:517'554 bytes
First seen:2020-10-02 08:32:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:sVbeDJ1bi6VtSbtfZ2wD3ikg95NNoUnhLRd9cGh7OrxaU:/nbi6efZP3CFndJZh7Oj
TLSH E4B423F2BD72ADF141053004CF86E95B88B3731D75266C2B96B32641A132CA7ABD58E5
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Yumei <jum@yiqioachina.com>"
Received: "from yiqioachina.com (unknown [103.151.124.245]) "
Date: "02 Oct 2020 01:13:40 -0700"
Subject: "Re: Overdue payment"
Attachment: "proforma invoice.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25fe24fc98f5d8bb89c0dba2a703123f848eeb7bc35c48bc557ca78122838b60/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-02 04:15:28 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ex7cj7ey6xmlxcoa3orkoaysh6ci5233ynoerpcvpstyciudrnqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/25fe24fc98f5d8bb89c0dba2a703123f848eeb7bc35c48bc557ca78122838b60

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 25fe24fc98f5d8bb89c0dba2a703123f848eeb7bc35c48bc557ca78122838b60

(this sample)

AgentTesla

Executable exe 4e655c620ed90cdbcd62d7c884c807cf82c8fff069da38d293dc746839597399

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e655c620ed90cdbcd62d7c884c807cf82c8fff069da38d293dc746839597399
  
Dropping
AgentTesla

Comments