MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80b5e4f0078513ca7070082ce023964ff3de11a20e93925b332fe2946c80f6df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80b5e4f0078513ca7070082ce023964ff3de11a20e93925b332fe2946c80f6df
SHA3-384 hash: 58046f9be0261b588e012f634f6317a6e91186c5eba6e41df8b79c4bbb75f9f161cf0fa321e83254f5761f2f81119c48
SHA1 hash: 410576e3d72739a61e56bf67286bdc5114fb0fff
MD5 hash: 82f39eac95a80518206315c974012f8b
humanhash: lion-emma-skylark-pip
File name:PO 4648_9605.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:46'890 bytes
First seen:2021-03-29 07:53:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:w1TPcg2adx2so+wHTssqM9zZ2xgVrqHRBcU+TE2p9XlbT/Wq+h05b5WavCZzlD/c:CTSa7wf9zFgHRBHUbXXRTk05tNvsNDo
TLSH D823025B23F1E97E74D2EFF181CBFEE48C835D66125FB6CA04D74951E2DE84444A0268
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp1.digital-max.fr
Sending IP: 185.111.19.53
From: pack@hossegor.fr
Subject: Re: PO Alert_PO# 4648 for Invoice
Attachment: PO 4648_9605.rar (contains "PO# 4648_9605.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80b5e4f0078513ca7070082ce023964ff3de11a20e93925b332fe2946c80f6df/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-29 07:54:06 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qc26j4ahquj4u4dqbawoai4wj7z54encb2jzewztf7rji3ea63pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/80b5e4f0078513ca7070082ce023964ff3de11a20e93925b332fe2946c80f6df

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 80b5e4f0078513ca7070082ce023964ff3de11a20e93925b332fe2946c80f6df

(this sample)

AgentTesla

Executable exe fe8e69539064f02829922daa446bed806a0fc74e0036d961f1fd53021444f529

  
Dropping
MD5 7ef3d2c5621572fef4fe6c898a68adf2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe8e69539064f02829922daa446bed806a0fc74e0036d961f1fd53021444f529

Comments