MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a74d23f4185a7ca5fd656dcc407791903f6c02ca8da224791adb914765ee754. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a74d23f4185a7ca5fd656dcc407791903f6c02ca8da224791adb914765ee754
SHA3-384 hash: d47b631ba439030f64b047f3727f9e20d91518c5de427145b3be0a1c1a49cac3ee6b9699cc0689c2ab76176240e3279e
SHA1 hash: 21a0a33f1f5d702e1dec8fc8a9760d572c38a6de
MD5 hash: e3d101aca7716fe2987929fd33043314
humanhash: jig-nuts-autumn-artist
File name:Money gram.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:512'111 bytes
First seen:2020-10-18 06:39:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:c5fqPcFp2LoqVvBu5sBThh38RBUFSk8wB/:mfCiyo6Y5snh37YwB/
TLSH 51B423E552688FC4487925236F708A5F14DFABC9E81CC3683342A96FD706B5CA334CE6
Reporter abuse_ch
Tags:AgentTesla FRA geo Outlook zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: EUR01-VE1-obe.outbound.protection.outlook.com
Sending IP: 40.92.66.93
From: Delphine GIRARD <dizys1@msn.com>
Subject: Re: Re: Re: Re: Re: A l'attende de vous lire
Attachment: Money gram.zip (contains "Money gram.exe")

AgentTesla SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisB0CFF698D1FD.29700.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a74d23f4185a7ca5fd656dcc407791903f6c02ca8da224791adb914765ee754/
Threat name:
ByteCode-MSIL.Infostealer.Racealer
Create hunting rule
Status:
Malicious
First seen:
2020-10-17 18:32:44 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lj2nep2bqwt4ux6wk3omib3zdeb7nqbmvdncer4rvw4ri5s645ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/5a74d23f4185a7ca5fd656dcc407791903f6c02ca8da224791adb914765ee754

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5a74d23f4185a7ca5fd656dcc407791903f6c02ca8da224791adb914765ee754

(this sample)

AgentTesla

Executable exe 3027bef9e4262ad05caadb38d130aeaed53ba3df25e3987b76f4d57a286f733b

  
Dropping
MD5 b0cff698d1fd64ef9a159e2dbea1abaf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3027bef9e4262ad05caadb38d130aeaed53ba3df25e3987b76f4d57a286f733b

Comments