MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5376b68e0c6dee8013b3f8c94e07e36199986210c691fa34f0d53dc2fc0c8e3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5376b68e0c6dee8013b3f8c94e07e36199986210c691fa34f0d53dc2fc0c8e3f
SHA3-384 hash: 8dab4bac9194e4b2adf6546fcc2b5f357fc47d5eb87bfa56256478c084ac676e8dffa30fd4a1df8e3c03926aedf3d60d
SHA1 hash: ee3278707e8de5983ce2c1edfe7b010a7f3e572f
MD5 hash: 42d4d0646e7a0e91c2cb28d6d54423cd
humanhash: batman-harry-vegan-nine
File name:PO14455.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'515'913 bytes
First seen:2020-10-28 09:04:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:kE+ZJCkLOv1agia5bNbzd1AhJiSFGrOePWIP/23KvZ39AtyMU9i1:kEhkLMana1td4J5FIOKWu234NAHUs1
TLSH 57C533D94D9B8D48505EEA1E3919087CC688867992E40F3DC9A644CB74DEFC3B98363F
Reporter abuse_ch
Tags:AgentTesla BitRAT lzh RAT


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: slot0.85xainji.com
Sending IP: 45.145.185.142
From: Javier Ruiz Praena <office@85xainji.com>
Subject: TOPHI PO14455
Attachment: PO14455.lzh (contains "PO#MX200012 2020-10-28 TOTS Amer Export GmbH.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5376b68e0c6dee8013b3f8c94e07e36199986210c691fa34f0d53dc2fc0c8e3f/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 08:28:19 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kn3lndqmnxxiae5t7deu4b7dmgmzqyqqy2i7unhq2u64f7amry7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5376b68e0c6dee8013b3f8c94e07e36199986210c691fa34f0d53dc2fc0c8e3f

(this sample)

BitRAT

Executable exe 07de346eaf5e067f031add746147af8fb0c1d9b77759880144b48ef8cc9a68da

  
Dropping
MD5 db5e8134256e1afec0a08451a5ced57e
  
Dropping
BitRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07de346eaf5e067f031add746147af8fb0c1d9b77759880144b48ef8cc9a68da

Comments