MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5615aa32a73902239c1f47f2865a87737e90551746a55cc6371ab4a8d5a4bdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5615aa32a73902239c1f47f2865a87737e90551746a55cc6371ab4a8d5a4bdf
SHA3-384 hash: 3ebf8a6309a1a998af9dd226e783cf781011fc93cc8f0a1907380ae96f07f9be0b92c46c58c9820b0fdcc1fae49dc729
SHA1 hash: b611526dccc125df0eaf6aab5981cbc59bc72b18
MD5 hash: b8dc64d5b7b367bfd19e766e7b335c33
humanhash: summer-triple-august-pizza
File name:PURCHASE ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'650 bytes
First seen:2020-10-22 06:14:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dYM109QsXoUTHLBXASYamcvJRqLzerKgPGVBD36w:dYf9QsXdPYamcvJs3erfGVBjB
TLSH 0694232EEA84E51196C746DB2E4FA54CC0F4C65671903EE86D27B3C327FC8A015B85EE
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cp.com
Sending IP: 185.222.57.141
From: Frances Anne Dumada-ug <frances.anne@cp.com>
Subject: RE: PURCHASE ORDER
Attachment: PURCHASE ORDER.rar (contains "QUOTATION.exe")

AgentTesla SMTP exfil server:
mail.goldenamoonresorts.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5615aa32a73902239c1f47f2865a87737e90551746a55cc6371ab4a8d5a4bdf/
Threat name:
ByteCode-MSIL.Coinminer.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 23:06:15 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  4/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uvqvvizkooiceoob6r7sqznio436sbkrorvfltddogvuvdk2jppq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a5615aa32a73902239c1f47f2865a87737e90551746a55cc6371ab4a8d5a4bdf

(this sample)

AgentTesla

Executable exe de86cb4227717aa6e3818fc1f0ec62d733b1e5e941f410db7c0065ea4c4f7e94

  
Dropping
MD5 306321ace762aec2a8d1ba29b7469da3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de86cb4227717aa6e3818fc1f0ec62d733b1e5e941f410db7c0065ea4c4f7e94

Comments