MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75a12afd08b81af87fca36c6ff75201c6351b11c6a7bbfde5c374f1238f6fdad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75a12afd08b81af87fca36c6ff75201c6351b11c6a7bbfde5c374f1238f6fdad
SHA3-384 hash: 5f70db6b1324632a1fe529e7ca8b6c309ed83029427b554893cc1e0891fe32cd92cbe66733e3eed68c050965433cefa5
SHA1 hash: a690a857266541a50b88689a0a643fd754899b42
MD5 hash: a50e06d4d7769933d2c2eb88e1433b4f
humanhash: fruit-whiskey-violet-oscar
File name:Invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:478'107 bytes
First seen:2021-02-25 12:12:20 UTC
Last seen:2021-02-26 11:38:38 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:WPKyCCCWmxpbfbkZ2EdCp/IJSYkoVa64Cr2cs/RNGYnV:WCyCCjebkMEdC+koVlr2csJB
TLSH 8AA42321A6611634E5232E698F8FE6F2C57494136790D04AC2EDEEAC92910EFBE4473D
Reporter cocaman
Tags:AgentTesla INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "<ashok.mahunta@jindalsteel.com>" (likely spoofed)
Received: "from [185.239.242.243] (unknown [185.239.242.243]) "
Date: "25 Feb 2021 15:43:01 +0100"
Subject: "Due Invoice"
Attachment: "Invoice.rar"

Intelligence

File Origin
# of uploads :
5
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75a12afd08b81af87fca36c6ff75201c6351b11c6a7bbfde5c374f1238f6fdad/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 12:13:06 UTC
File Type:
Binary (Archive)
Extracted files:
61
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=owqsv7iixanpq76kg3dp65jadrrvdmi4nj537xs4g5hreohw7wwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 75a12afd08b81af87fca36c6ff75201c6351b11c6a7bbfde5c374f1238f6fdad

(this sample)

AgentTesla

Executable exe 63e89e3a9aa5843b13a2148eb97a2a2168f15953ec31a31d819b29e770bb7ac0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 63e89e3a9aa5843b13a2148eb97a2a2168f15953ec31a31d819b29e770bb7ac0
  
Dropping
AgentTesla

Comments