MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2c5f4e6519cedc9b5204f7a39c0ca581cc2dae5236556cc21ad9c4a7aa016f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2c5f4e6519cedc9b5204f7a39c0ca581cc2dae5236556cc21ad9c4a7aa016f1
SHA3-384 hash: 16c7ad5a325091a2090617b2d0a6c949fa43ba3f5dfbaa6764cb1b768a697812694a2a0992e9594ed7be26370ccc39db
SHA1 hash: ea41c4f0b0f13dc5531e434dc12d6e9bc3028e4a
MD5 hash: 844a4f63b385a1439b5fc976b08bf4c0
humanhash: mirror-snake-eleven-island
File name:PRO FORMA INVOICE TWETS001_PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:387'671 bytes
First seen:2020-06-12 09:29:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:XnnCbFmOSzQHGWAZD3ykVfCt5F5H1a+TLBY5lARGhCNpAtcc26UJKkgB8wKhvg3O:XnWczQHGtya6V5H1bocWCNpAtcF6U4kp
TLSH 2C842303E425B03B7B9FC8528FDD5E987821970E6C76CC660E15C10BC129E9D9EE74AE
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.carryboy.com
Sending IP: 27.254.141.68
From: Jocelyn Chen <prasong@carryboy.com>
Subject: RE: SO L014, TPEA73033
Attachment: PRO FORMA INVOICE TWETS001_PDF.rar (contains "PRO FORMA INVOICE TWETS001_PDF.exe")

AgentTesla SMTP exfil server:
smtp.moorefundz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 09:31:05 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wlc7jzsrttw4tnjaj55dtqgklaomfwxfensvntbbvwoeu6vac3yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b2c5f4e6519cedc9b5204f7a39c0ca581cc2dae5236556cc21ad9c4a7aa016f1

(this sample)

AgentTesla

Executable exe b1603b913f811ff40a9365527d9900b7dd099ccc27fc596f2ed7a2027a640851

  
Dropping
MD5 4d0a8d0948ff3c56955879fc0b5396ca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1603b913f811ff40a9365527d9900b7dd099ccc27fc596f2ed7a2027a640851

Comments