MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8cfb0592cc64af3cc215ca4312afd40783dce4df7f2c2291914609af10cf95e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8cfb0592cc64af3cc215ca4312afd40783dce4df7f2c2291914609af10cf95e
SHA3-384 hash: b7059a68c63ec3edda3a3236c98d3c0332a828c7871041c0eadd2b7672580901b54d58a4306b3a16c0c2d60c129858f6
SHA1 hash: 65c75c3d287d5d49aa72b997d88b7ec3520f5545
MD5 hash: baa817a022bc2074ebf03e88e7958a84
humanhash: nitrogen-princess-cola-pasta
File name:INV..6588965..PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:469'661 bytes
First seen:2020-11-06 15:09:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:+GpITWgPnz90M+vSBah4cJJyZmip75a0hn4ma8g8:pIB9Z+vRJJyW0V4mdD
TLSH D4A423A0A1E317E7DFB617F45DD4886B80C2343C485E2BAE404AA19A0CD5C97267F97F
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Xoom" <office@gemdras.xyz>" (likely spoofed)
Received: "from gemdras.xyz (rdns0.gemdras.xyz [157.230.219.11]) "
Date: "Fri, 06 Nov 2020 06:07:06 -0800"
Subject: "Payment slip"
Attachment: "INV..6588965..PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8cfb0592cc64af3cc215ca4312afd40783dce4df7f2c2291914609af10cf95e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 17:28:53 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5dh3awjmyzfphtbblssdckx5ib4d3tsn67zmekizcrqjv4im7fpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e8cfb0592cc64af3cc215ca4312afd40783dce4df7f2c2291914609af10cf95e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e8cfb0592cc64af3cc215ca4312afd40783dce4df7f2c2291914609af10cf95e

(this sample)

AgentTesla

Executable exe f41724b34636a2b2dc0e76328e88be75b5240c7221024f49033fa6fb2648cf16

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f41724b34636a2b2dc0e76328e88be75b5240c7221024f49033fa6fb2648cf16
  
Dropping
AgentTesla

Comments