MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a1313bd80d946f5002832471885a36c021c169ae1cfb3458cdac5690b70aaaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a1313bd80d946f5002832471885a36c021c169ae1cfb3458cdac5690b70aaaa
SHA3-384 hash: 3c385acc0c218fa39034739b737e9bd0565e2b52eb1b6069910cd1b250d3ad6d6e5801d1bfc66ab69d5c228ce19766bf
SHA1 hash: a8b3687d89b331c70d9772806b672c35317aa17b
MD5 hash: 21328147e991555f5314df14a7b05b14
humanhash: august-avocado-florida-maine
File name:Prueba de pago.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'015 bytes
First seen:2020-12-02 09:16:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:BJIfHFnhCcVrKJ84nN5fsSSHrGeVrah4CMopgy6fnDpSk8f0v+LIac:BJWFhDrqVBcrGg6Mfkv4ii
TLSH 558423AFBD724B691FDB7415ED63551833110896BF2E4711ED20EAC4C6B887F7288B0A
Reporter abuse_ch
Tags:ESP geo rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: prometheus.acosis.net
Sending IP: 194.143.219.149
From: Comercial <sandra.sanchez@multiforma.es>
Reply-To: Comercial' <marcusdrnd@gmail.com>
Subject: Re: Prueba de pago.
Attachment: Prueba de pago.rar (contains "Prueba de pago.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.20243.2520.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a1313bd80d946f5002832471885a36c021c169ae1cfb3458cdac5690b70aaaa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lijrhpma3fdpkabigjdrrbndnqbbyfu24hh3grmm3lcwsc3qvkva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5a1313bd80d946f5002832471885a36c021c169ae1cfb3458cdac5690b70aaaa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5a1313bd80d946f5002832471885a36c021c169ae1cfb3458cdac5690b70aaaa

(this sample)

AgentTesla

Executable exe 69710a605be0e7ffded4a0156f7823e29dc0f1b2ceff785465d3fd094802de07

  
Dropping
MD5 0d595d14406499fde6b61183154ffc8b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69710a605be0e7ffded4a0156f7823e29dc0f1b2ceff785465d3fd094802de07

Comments