MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5fc13df1012b247693e929efee6d5fd62154f0146ce945ad212921705a12d88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5fc13df1012b247693e929efee6d5fd62154f0146ce945ad212921705a12d88
SHA3-384 hash: 850ff5a50ae5cc2b5ef5149f850b146da4f7024dd1568d0a2f5ae4c7c1cf42574f70fee476a31606c694a9e94a93b32d
SHA1 hash: e6fa092aa783ddadbcd9a1cc758708f5b93bae46
MD5 hash: c00ca1fea6da7b09977799bc58d630f0
humanhash: illinois-johnny-magazine-fillet
File name:INV 19003568.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:500'959 bytes
First seen:2020-08-18 13:11:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:33w/alSfdKJIxBrEqjmormYUduohW3jaId+dvGA8pn:H6FKMvC13Q3jaI6LM
TLSH E0B4239415B3FEC39FED49206A5DFBB651030A09D29EA1610667BCD0898C936FDA33F4
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: epsp.fr
Sending IP: 103.133.104.130
From: Manel HSOUMI <sales3@epsp.fr>
Reply-To: Manel HSOUMI <sales3@epsp.fr>
Subject: RE: Invoice Confirmation
Attachment: INV 19003568.rar (contains "INV 19003568.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5fc13df1012b247693e929efee6d5fd62154f0146ce945ad212921705a12d88/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:13:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ux6bhxyqckzeo2j6skpp5zwv7vrbktybi3hjiwwsckjbobnbfwea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5fc13df1012b247693e929efee6d5fd62154f0146ce945ad212921705a12d88

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a5fc13df1012b247693e929efee6d5fd62154f0146ce945ad212921705a12d88

(this sample)

AgentTesla

Executable exe bcfe28b074cc1d9b0fb7896ee3eb4d28c240bee33cb76578f0f9f1ef90ab92e6

  
Dropping
MD5 a887535cacc5f53e18904e84b5936037
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bcfe28b074cc1d9b0fb7896ee3eb4d28c240bee33cb76578f0f9f1ef90ab92e6

Comments