MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2d1380d9c4f3b9ba15f8464768153025796079a2d057bfc6684c50ff0241523. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2d1380d9c4f3b9ba15f8464768153025796079a2d057bfc6684c50ff0241523
SHA3-384 hash: cb51104b0d2127912919c54781d63d0883326d076cf4b46d7a6efdddc2ddb53751ed217ff462d319d0d871c8bc2220d4
SHA1 hash: 15dd2a096e55581081c7b545ab85b3d5c8753959
MD5 hash: d170bf1e9bf0f43c4c85a86996c22970
humanhash: double-red-whiskey-skylark
File name:INVOICE 2 B9016492377.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:12'869 bytes
First seen:2020-10-07 16:43:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:DuUJBFIKBjucU7BItzcKty0uyEzGPkQCmt:Du8FZ5uDBI9i3IVzt
TLSH 4F42C0BE3E43DB175B7B446EF7D74E604C5A4512CA8BD24623FDA08226C19BB5703217
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.devbox12.com
Sending IP: 162.249.2.44
From: Accounts <manuz-e@marudeni.com>
Reply-To: Accounts <allryhan2009@yahoo.com>
Subject: Proforma Invoice accordingly to arrange 50% down payment and 50% balance
Attachment: INVOICE 2 B9016492377.rar (contains "INVOICE 2 B9016492377.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2d1380d9c4f3b9ba15f8464768153025796079a2d057bfc6684c50ff0241523/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 15:57:21 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulitqdm4j45zxik7qrshnaktajlzmb42fucxx7dgqtcq74becurq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a2d1380d9c4f3b9ba15f8464768153025796079a2d057bfc6684c50ff0241523

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a2d1380d9c4f3b9ba15f8464768153025796079a2d057bfc6684c50ff0241523

(this sample)

AgentTesla

Executable exe c6891bfbe19115c4a3f0c80a3be5ea9bf19e76d6933b8b3ef88158fd1679e38a

  
Dropping
MD5 d5c227f9217d13263d97f4a6236e559d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c6891bfbe19115c4a3f0c80a3be5ea9bf19e76d6933b8b3ef88158fd1679e38a

Comments