MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a1e378b26fa2134be268620e77fa714ccc8d8083f88541cb8b9978a5e4ec5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28a1e378b26fa2134be268620e77fa714ccc8d8083f88541cb8b9978a5e4ec5a
SHA3-384 hash: 18e7ac3b519a660ed1f181a2db6806fe8cfb5bd115f4e3559c8be8b85a05f4098527f1dcdf6154f930654e0e2d70b729
SHA1 hash: 354638726b8a93391621889df14e36030cd376ef
MD5 hash: e9750bf7d6c7c3befb6e9a7b6457990d
humanhash: low-fruit-delta-green
File name:INVOICE 54598.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'086'440 bytes
First seen:2020-05-25 12:26:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:G/eJfAeDR4ArU7d8mBFNwi2cJVi9mDZJuqOsJF4EKFvwiR:GWXDBrdW2MgsuZCVC
TLSH 923533C1A3705B39648963724F9A3E809C6F0F2C75EB74BB5500B4A122B1A1763D7ADF
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: finlays.lk
Sending IP: 103.99.1.173
From: Nishan Wickramarathna<nishanw@finlays.lk>
Subject: ADVISE BEST RATE FOR NEW SHIPPMENT
Attachment: INVOICE 54598.rar (contains "INVOICE 54598.exe")

AgentTesla SMTP exfil server:
mail.niftylabs.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:30:59 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 28a1e378b26fa2134be268620e77fa714ccc8d8083f88541cb8b9978a5e4ec5a

(this sample)

AgentTesla

Executable exe 320879773263bbe2f56ec72ab36ca0cb654b895c44d99435101a29305b82c866

  
Dropping
MD5 16fa6d4d8768e3d932f6f61c7be3e540
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 320879773263bbe2f56ec72ab36ca0cb654b895c44d99435101a29305b82c866

Comments