MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1a5a5bd71b502312a7d3bc018781a5774dc1979db34d776edde934899099dcd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1a5a5bd71b502312a7d3bc018781a5774dc1979db34d776edde934899099dcd
SHA3-384 hash: d7c56b2b0b1ce5b4d5339f811b621e29e303b36be37ddde5b4fc29901dd27f095e6b94cfad232bf1f972547757484576
SHA1 hash: 56fe7d715efbf7f7d517685592d10f15dae5e091
MD5 hash: 5b483e4e5a42613c85804af9608c4989
humanhash: minnesota-maine-massachusetts-cola
File name:TOP URGENT QUOTATION FROM BTCpower.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:492'564 bytes
First seen:2020-07-15 06:06:42 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:UUXpRQ+yOBmW5nYpPHQ/sdUwi8j3bLy8Q18dgRjHMEWExKpPReRcuJVRLUXhcycp:lQ+gGn6as+XqdgRjsERcR4ZZ+WZqm
TLSH 56A4239FBCEBBD7F93AB5D704B80925CDA81DE48ED07D609D20622FD94A096890DC5CC
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Frank Raymond <sales@btcpower.com>
Received: from btcpower.com (unknown [37.48.85.232])
Date: 15 Jul 2020 05:57:14 -0700
Subject: TOP URGENT QUOTATION FROM BTCpower
Attachment: TOP URGENT QUOTATION FROM BTCpower.pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1a5a5bd71b502312a7d3bc018781a5774dc1979db34d776edde934899099dcd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-15 06:08:05 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygs2lplrwubdckt5hpabq6a2k52nyglz3m2no5xn32jurgijtxgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c1a5a5bd71b502312a7d3bc018781a5774dc1979db34d776edde934899099dcd

(this sample)

AgentTesla

Executable exe 3015000bbb620cea84b4553323e96cd6f58fb3600ac57695dec5ba84a4022778

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3015000bbb620cea84b4553323e96cd6f58fb3600ac57695dec5ba84a4022778

Comments