MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55921ca4f5c34584d7638e1a706a648ecb3c5df8bcf55c7a4ee7600920ec820f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55921ca4f5c34584d7638e1a706a648ecb3c5df8bcf55c7a4ee7600920ec820f
SHA3-384 hash: 0bd28c57c819676b38ebe4eae5188fbc3958e34da262dcb7063e4b491ab2ccea23b63b7f9415b3f64131b9ce8ff3e7ae
SHA1 hash: 3837e7942cdc455cce881be41f906a923cdc55d3
MD5 hash: 65111a03f79766fce360f53e59961b33
humanhash: mexico-spaghetti-eleven-maine
File name:INVOICE.pdf.ar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:450'574 bytes
First seen:2021-03-05 20:54:43 UTC
Last seen:2021-03-06 11:01:45 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:nFtgZcg4ZpUyJJyEpLtPcK1enYenjRjciDtH6L:nbpbU8ZpLtkKOTnjVjDtaL
TLSH 7EA423458BF341674E962BE539190FD539003DC03BAE8596D2BE1F20DA7182AD6CD2FB
Reporter cocaman
Tags:AgentTesla ar INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: "Atina Wu <accounts@sc.com>" (likely spoofed)
Received: "from sc.com (unknown [142.147.97.145]) "
Date: "5 Mar 2021 15:12:54 -0800"
Subject: "Re:The Reply From Bank"
Attachment: "INVOICE.pdf.ar"

Intelligence

File Origin
# of uploads :
10
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55921ca4f5c34584d7638e1a706a648ecb3c5df8bcf55c7a4ee7600920ec820f/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 09:51:33 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kwjbzjhvyncyjv3drynha2ter3ftyxpyxt2vy6so45qasihmqihq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55921ca4f5c34584d7638e1a706a648ecb3c5df8bcf55c7a4ee7600920ec820f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 55921ca4f5c34584d7638e1a706a648ecb3c5df8bcf55c7a4ee7600920ec820f

(this sample)

AgentTesla

Executable exe 9d533e1a5e529d1f7b30f0f6ef8d1322b34878b70435c9892d673a1dccca689e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d533e1a5e529d1f7b30f0f6ef8d1322b34878b70435c9892d673a1dccca689e
  
Dropping
AgentTesla

Comments