MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1758a3fb8e5920928e6d1516ea66f02187876d99efabe7e74ea32284a1b6d11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1758a3fb8e5920928e6d1516ea66f02187876d99efabe7e74ea32284a1b6d11
SHA3-384 hash: 27d49fed15ffcaadaf415296775d780d95d0558a70b9f269c6e2e650372e902a1f462a1abedd9dd6277b63fb266c375b
SHA1 hash: e1464757b4a122fad01b7512a73c5a7b9f7ff36e
MD5 hash: 7954c58bbdd4af32f53cd826de090e54
humanhash: sink-venus-johnny-oven
File name:Proforma Invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:532'510 bytes
First seen:2020-10-10 07:07:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:o0CI6BPFV4PGTBLwCoz57HxISnkda5J2TTAY4I/jGs6PRkwP:BqBTb9SHuQont/86c
TLSH 23B433D46FBEA8772686465DEF9E80CF3BAC3DA60D273446A1679D01C090429F1389F7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns10.metro.net.bd
Sending IP: 103.36.103.52
From: service@made-in-china.com
Subject: Proforma Invoice with Revised Payment..
Attachment: Proforma Invoice.zip (contains "Proforma Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1758a3fb8e5920928e6d1516ea66f02187876d99efabe7e74ea32284a1b6d11/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 21:26:30 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yf2yup5y4wjaskhg2fiw5jtpaimhq5wzt35l47tu5izcqsq3nuiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1758a3fb8e5920928e6d1516ea66f02187876d99efabe7e74ea32284a1b6d11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c1758a3fb8e5920928e6d1516ea66f02187876d99efabe7e74ea32284a1b6d11

(this sample)

AgentTesla

Executable exe c5a82d840d865ea9d1f28c5d58a676d47d76de746bbfbeecfd0569f9ae476bff

  
Dropping
MD5 5a52f658d7ac037dbf02a51f84bb41fb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5a82d840d865ea9d1f28c5d58a676d47d76de746bbfbeecfd0569f9ae476bff

Comments