MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96045eee3717f4f0f661f0de81f0ed1ac779305d8c03bfeaba6d15de30e55e47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96045eee3717f4f0f661f0de81f0ed1ac779305d8c03bfeaba6d15de30e55e47
SHA3-384 hash: 984be94d262e591f710a60663188b3767d85b095654211b85fa86b722cc5fadf38a52dcd5130206c144c4162676c4411
SHA1 hash: 62626735422eb37726f9fdbe7186b062a315fe39
MD5 hash: da47cdffd70c037d6ec10e5fb8503925
humanhash: apart-enemy-arkansas-spaghetti
File name:Comprobante de transferencia.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:354'818 bytes
First seen:2021-01-06 16:33:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vvo0gyptXS/9Z5CWft6+YFrXp2o6i0kl7g1FMUYTb7KEBaXc1A+n9Dx+z+NUwA:vvo0ptX2//6n1p2Q7g7MUEKEcXb+n9Yv
TLSH FD742359ADD3E42CBF02B6C161B9CC2AA4A50A67C756F0CCF9209F3E59BEC3205D494D
Reporter abuse_ch
Tags:ESP geo rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.osmispee.com
Sending IP: 45.85.90.199
From: Javier Sánchez <comercal@gervasport.es>
Reply-To: Comercial' <marcusdrnd@gmail.com>, Javier Sánchez <yos.afffandi@gmail.com>
Subject: Re: Justificante de la transferencia
Attachment: Comprobante de transferencia.rar (contains "Comprobante de transferencia.com")

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.11341.31884.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96045eee3717f4f0f661f0de81f0ed1ac779305d8c03bfeaba6d15de30e55e47/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-06 16:34:04 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sycf53rxc72pb5tb6dpid4hndldxsmc5rqb372v2nuk54mhflzdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/96045eee3717f4f0f661f0de81f0ed1ac779305d8c03bfeaba6d15de30e55e47

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 96045eee3717f4f0f661f0de81f0ed1ac779305d8c03bfeaba6d15de30e55e47

(this sample)

AgentTesla

Executable exe 122efe2f5bdfc7dff383279a644ea982eb45a71d28a72d5af96ae661d3337967

  
Dropping
MD5 06a745b1189c958edbe3145896141351
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 122efe2f5bdfc7dff383279a644ea982eb45a71d28a72d5af96ae661d3337967

Comments