MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a59141e2b754f964d092ce9ea063f29e20279ab94bea2e563e2b6f8f51181be7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a59141e2b754f964d092ce9ea063f29e20279ab94bea2e563e2b6f8f51181be7
SHA3-384 hash: b18b8ec085cba3efccc5f1e5372f405d7cd321b5933480b3a2a5e1b81cb0ff23959069b81c3c66a5a728b1bea72f0b11
SHA1 hash: f1dbbb41fa676d3bb59a0c6548e220fe97956029
MD5 hash: 27c935091008731478a2b72a12a9369c
humanhash: utah-rugby-yellow-equal
File name:OUTSTANDING INVOICES.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'863 bytes
First seen:2020-06-15 05:29:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:vxpA8oU9bN1C27lGIHGTxQdJWVEVIcdR9ieplOJH45UrHzGnRj8nADXftgYuGT83:Ii5XC2RGIHFJWYIc3bplON45Ufaw0X1o
TLSH 5184237BE5B8B205633D4C3AD9666E11EB83CF00CDB550A0094722BDBDF6B83B48D946
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se1f-lax1.servconfig.com
Sending IP: 173.231.224.6
From: Iva Váňová <iva.vanova@cargomind.com>
Subject: RE:OUTSTANDING INVOICES
Attachment: OUTSTANDING INVOICES.rar (contains "OUTSTANDING INVOICES.exe")

AgentTesla SMTP exfil server:
mail.travelsapphire.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-14 23:59:25 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
28 of 47 (59.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwiudyvxkt4wjuesz2pkay7styqcpgvzjpvc4vr6fnxy6uiydptq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a59141e2b754f964d092ce9ea063f29e20279ab94bea2e563e2b6f8f51181be7

(this sample)

AgentTesla

Executable exe f5116a3b4f8eb0b407c431212e3b7fd832dfd8d068347746d3ba615845ecac31

  
Dropping
MD5 a167b18197244c8a1dc7cea8665f2a4c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5116a3b4f8eb0b407c431212e3b7fd832dfd8d068347746d3ba615845ecac31

Comments