MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a924e3fdcad5b585878b7959b8dd13f134d64e55491cc4334a947b4f2f039b6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a924e3fdcad5b585878b7959b8dd13f134d64e55491cc4334a947b4f2f039b6e
SHA3-384 hash: d31a890c15a1af05d91319068a9c7d5c27741f02fcc7bc3cf977116363f70493748bf6d5e629bfd21beb2095d709c74d
SHA1 hash: 0f64eee2805e48fc11983ee41952a6fab104efa5
MD5 hash: 910b8b671c891cb01e16d7f493c341c2
humanhash: romeo-papa-hawaii-diet
File name:UNPIAD INVOICES.R00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:228'331 bytes
First seen:2020-11-06 07:09:46 UTC
Last seen:Never
File type: r00
MIME type:application/gzip
ssdeep 6144:kfk8x/WoSauNSmCe4c03QJUK4/bbjXhGQFDQR:kfk8x+o4V/4NOx4nlvkR
TLSH 6B2423830FF5C13E47DB1B65B646CD5B4A9548C10B8A1DCAAFCA0683CE8D720E5D762E
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: walmailout01.yourhostingaccount.com
Sending IP: 65.254.253.91
From: corp.comm@verga.biz
Subject: Unpaid Invoices
Attachment: UNPIAD INVOICES.R00 (contains "UNPIAD INVOICES.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Msilheracles-9786346-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a924e3fdcad5b585878b7959b8dd13f134d64e55491cc4334a947b4f2f039b6e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 19:44:15 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vesoh7ok2w2ylb4lpfm3rxit6e2nmtsvjeomim2ksr5u6lydtnxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 a924e3fdcad5b585878b7959b8dd13f134d64e55491cc4334a947b4f2f039b6e

(this sample)

AgentTesla

Executable exe 57e26a2814ba37cbeb74f1df6ff7c4b4190f67e15d163468874fa400179725af

  
Dropping
MD5 f8e241fffb35dd312f28c4c52ba53278
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 57e26a2814ba37cbeb74f1df6ff7c4b4190f67e15d163468874fa400179725af

Comments