MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 813cd5423a2884a346d82fd1e1b674d176feb999392422c74160828ce08d0c15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 813cd5423a2884a346d82fd1e1b674d176feb999392422c74160828ce08d0c15
SHA3-384 hash: 7972c826636abaf733d7166d75ba7dd9623ee1af10af28d1902b9bf11ddf921a997a017caffa763d26afcc908c7e620d
SHA1 hash: 1d5167b842872358c7ad982249896a3e594b528e
MD5 hash: f08c9c74509b74a8df36d10a80d18bdb
humanhash: carbon-montana-friend-hawaii
File name:DUE_INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'617 bytes
First seen:2020-11-10 06:33:22 UTC
Last seen:2020-11-11 00:20:35 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:AdT4SdwHsoM7SCUP0+ezEQuvZJP4J9ivyxIX5:A14SmMXun0+AEQUZ1Tvyi5
TLSH 0C9423BE708CFAA7D026FD18A03CA0207ED351E52672350E492ED15BBF16925773A16F
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Frank Boykins<ir@thaioilgroup.com>" (likely spoofed)
Received: "from thaioilgroup.com (unknown [45.137.22.131]) "
Date: "9 Nov 2020 12:50:58 -0800"
Subject: "November 2020 Current Outstanding"
Attachment: "DUE_INVOICE.zip"

Intelligence

File Origin
# of uploads :
4
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/813cd5423a2884a346d82fd1e1b674d176feb999392422c74160828ce08d0c15/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 15:45:32 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qe6nkqr2fcckgrwyf7i6dntu2f3p5omzhescfr2bmcbizyenbqkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 813cd5423a2884a346d82fd1e1b674d176feb999392422c74160828ce08d0c15

(this sample)

AgentTesla

Executable exe 56c026a1b3db5b77e3d01e2ef5f727cae05b34e19fd01055ee1ba374bba3af5f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56c026a1b3db5b77e3d01e2ef5f727cae05b34e19fd01055ee1ba374bba3af5f
  
Dropping
AgentTesla

Comments