MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b376aa586fc486433fe753ebbeb771b79a0f39980dedefad635983b9db7b57d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b376aa586fc486433fe753ebbeb771b79a0f39980dedefad635983b9db7b57d7
SHA3-384 hash: 8032239f555fc5c71032a074bf292bd9c5415abd6f089f22cf27e311f34af5d167f7a7dc4c93251ee6b3278fd3ece653
SHA1 hash: a6b33530ca16498195c2131f1d9409169c189d99
MD5 hash: a4558b19e86411e5fdab3c11075a1344
humanhash: happy-pip-music-cardinal
File name:AD1-2001328L_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:382'678 bytes
First seen:2020-09-24 16:51:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Rp9HYQh6PokQQqpiLyI6q3kHHOObJ9qGj6twbzdphFRq9bwrein6wm1jBl5J:RprhEokjqwLd38bHqHwfhFRq9SnlgjT
TLSH ED8423437606EF7D21AAF01F928C4B5495EE8390DEC71B168DE26CC62B816CF61463B3
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "UV Hitech Pvt. Ltd. <info@uvmkt.com>"
Received: "from vade-backend20.dreamhost.com (fltr-in2.mail.dreamhost.com [66.33.205.213]) "
Date: "24 Sep 2020 09:51:02 -0700"
Subject: "invoices for shipments Details"
Attachment: "AD1-2001328L_pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b376aa586fc486433fe753ebbeb771b79a0f39980dedefad635983b9db7b57d7/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 16:53:05 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wn3kuwdpysdegp7hkpv35n3rw6na6omybxw67lldlgb3tw33k7lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b376aa586fc486433fe753ebbeb771b79a0f39980dedefad635983b9db7b57d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b376aa586fc486433fe753ebbeb771b79a0f39980dedefad635983b9db7b57d7

(this sample)

AgentTesla

Executable exe cc0362a0c84cc29c65b62af19019e3a810d69ffc46e5e40b08aedbe333659cd7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc0362a0c84cc29c65b62af19019e3a810d69ffc46e5e40b08aedbe333659cd7

Comments