MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54ca61ec982bde21aeaadab8529cd81e950e26421934c016f6997720420e4e61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54ca61ec982bde21aeaadab8529cd81e950e26421934c016f6997720420e4e61
SHA3-384 hash: c2c65a8a35182e4f4f790c0d9492f1aee75e37c2b028e08c47f754977189c0be7b47c28b15661f1015d515eddc9ecc66
SHA1 hash: ce61d335bb4abe941f1a2380e47f84bdcb67ab20
MD5 hash: 072bed5c1be3e2bbeb31b88f8fc7082c
humanhash: hotel-jupiter-alpha-hawaii
File name:訂單請確認--Vacuubrand PO. 106-010-283.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:567'647 bytes
First seen:2020-10-29 08:40:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0kRBFBpR6xGV/Mt94uGyQs9+4m62Kpp3kBiC:0mBpYxGVUt94uGts9+4m6P3kMC
TLSH 4FC4234596590B32E06DFDF4F6534BAE5F6ED221284354EFF5E0D38C2622BA2D10C2A7
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "info <info@ivorist.com.tw>"
Received: "from ivorist.com.tw (unknown [185.222.57.240]) "
Date: "29 Oct 2020 01:19:53 -0700"
Subject: "=?UTF-8?B?6KiC5Zau6KuL56K66KqNLS1WYWN1dWJyYW5kIFBPLiAxMDYtMDEwLTI4LzM=?="
Attachment: "訂單請確認--Vacuubrand PO. 106-010-283.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisF57D5250D54F.17656.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54ca61ec982bde21aeaadab8529cd81e950e26421934c016f6997720420e4e61/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 08:42:05 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktfgd3eyfppcdlvk3k4ffhgyd2kq4jscde2mafxwtf3saqqojzqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 54ca61ec982bde21aeaadab8529cd81e950e26421934c016f6997720420e4e61

(this sample)

AgentTesla

Executable exe c65f59e46bf3f95dd36355588b2b1661ac61878e1ce97364ff2c9bc9e5392e03

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c65f59e46bf3f95dd36355588b2b1661ac61878e1ce97364ff2c9bc9e5392e03

Comments