MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac8efd9a8c56ee91cebaf035caf4afe7f57621356fda2ed9ac8862afbceb13bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac8efd9a8c56ee91cebaf035caf4afe7f57621356fda2ed9ac8862afbceb13bf
SHA3-384 hash: 1add4693a6c7ac2975c40a9ea5f5ed618f54b1f306527cca949b3899cb07ad68ed4223c68935cd4220cdb9a52974221d
SHA1 hash: a4faa2823ac45ce2e2525678ff60be1a3398a420
MD5 hash: fdb7443ffc87abb9074fdea238803cb8
humanhash: timing-sink-stream-batman
File name:PROFORMA INVOICE.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:595'748 bytes
First seen:2020-12-01 07:46:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:DI41u0uGGwuj+2HZmwaS+R4vik4pc4rZgnfAgg8:B1u0Ita2HZmw5blGcG+88
TLSH 3FC4233A0BD43C3813C981163D6DD0E066714775D94AC26CECEE9FF7EA30B19AB22959
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Young<info@hxscaffolding.com>" (likely spoofed)
Received: "from hxscaffolding.com (unknown [92.118.190.190]) "
Date: "1 Dec 2020 07:42:57 +0100"
Subject: "PROFORMA "
Attachment: "PROFORMA INVOICE.Z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac8efd9a8c56ee91cebaf035caf4afe7f57621356fda2ed9ac8862afbceb13bf/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-01 07:47:06 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vshp3gumk3xjdtv26a24v5fp472xmijvn7nc5wnmrbrk7phlco7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ac8efd9a8c56ee91cebaf035caf4afe7f57621356fda2ed9ac8862afbceb13bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z ac8efd9a8c56ee91cebaf035caf4afe7f57621356fda2ed9ac8862afbceb13bf

(this sample)

AgentTesla

Executable exe 4971d77281b7cf838a77d4cab1f80579732e26f24db47a8e94e883d9234c32b1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4971d77281b7cf838a77d4cab1f80579732e26f24db47a8e94e883d9234c32b1
  
Dropping
AgentTesla

Comments