MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8874f98b89017cb58ba29df1b5fe7a897565e1c3720c53d0ea450953af5a110. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8874f98b89017cb58ba29df1b5fe7a897565e1c3720c53d0ea450953af5a110
SHA3-384 hash: 8559afe480fd77c9354553cda62317a6c3bcaa5addbb571a5ccb10b4d48fe9d93be71dd4cfacfec3530573d20220ec91
SHA1 hash: 9d1b6cd81f1eb9d283ff72d5df015825ed8c666f
MD5 hash: 7d269e698c684ab4e89bac2e295f7ac1
humanhash: four-carbon-juliet-bakerloo
File name:CORRECT INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'695 bytes
First seen:2020-11-26 06:57:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yvN+8+j+Zd+AitUqKMLtKTyGHPPIgxT8jYSTe4q:S2aIAibRLt+TA0Oxq
TLSH 5894230F99EFD85DFAEA17558A7EE60E4A14635BE4C28C175CD0866ADC13200BE7423F
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "HANNA sales.phuckhangvn@gmail.com" (likely spoofed)
Received: "from postfix-inbound-5.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "25 Nov 2020 23:29:50 +0100"
Subject: "CORRECT INVOICE(VERY IMPORTANT)"
Attachment: "CORRECT INVOICE.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8874f98b89017cb58ba29df1b5fe7a897565e1c3720c53d0ea450953af5a110/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-25 04:46:16 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5cdu7gfysal4wwf2fhprwx7hvclvmxq4g4qmkpiourijkoxvueia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e8874f98b89017cb58ba29df1b5fe7a897565e1c3720c53d0ea450953af5a110

(this sample)

AgentTesla

Executable exe ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97
  
Dropping
AgentTesla

Comments