MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5a30521a528fb6be8f6feaae69bee6e37a7020b0c0d0c6ee43bb93c15bdcd8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5a30521a528fb6be8f6feaae69bee6e37a7020b0c0d0c6ee43bb93c15bdcd8d
SHA3-384 hash: 5eed08e4c1aadf7b607395e490eb9a8aca13629a0ca671a8e170f3b523bd2492c400b8533c5d795aa860011eaa69ff88
SHA1 hash: bfb36662ffc859e16fe5d276d9ab4f5095b3635f
MD5 hash: 55c48be1e534711d372f56e1a1f41cb6
humanhash: freddie-quiet-wyoming-potato
File name:Purchase Order - 20200625.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:459'081 bytes
First seen:2020-06-25 12:15:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:II5gFZ/+klM61QuAp2kvkPY9c2T0CSU5Lc:z50PlTVkjnd5Lc
TLSH 00A4239BC965373231A5976B4B605B585B3F9620ABC1C7723BF9B02AF5CB284C71830D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.bunasta.eu
Sending IP: 89.249.90.14
From: pl@bunasta.eu
Subject: Re: New Purchase Order
Attachment: Purchase Order - 20200625.rar (contains "Purchase Order - 20200625.exe")

AgentTesla SMTP exfil server:
samiprinting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5a30521a528fb6be8f6feaae69bee6e37a7020b0c0d0c6ee43bb93c15bdcd8d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 12:36:19 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2wrqkinffd5wx2hw72vong7ony32oaqlbqgqy3xeho4tyfn5zwgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d5a30521a528fb6be8f6feaae69bee6e37a7020b0c0d0c6ee43bb93c15bdcd8d

(this sample)

AgentTesla

Executable exe d81a62374f272db1fb132e559725293c11b77b443b89b21492a87564e64eb428

  
Dropping
MD5 55ea9599254e19967f98f22da189f8e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d81a62374f272db1fb132e559725293c11b77b443b89b21492a87564e64eb428

Comments