8058fdac57a403fa90c6b7d69567bbc0a829599a8e93543cc2e51f9177becb24

Classification: Malicious

8058fdac57a403fa90c6b7d69567bbc0a829599a8e93543cc2e51f9177becb24 is a malicious file sample. Linked to Agent Tesla malware. Detected by 36 antivirus engines.

Detection summary

  • 36 antivirus detections
  • 2 IDS alerts
  • 5 processes observed
  • 2 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: AGENT TESLA (S0331)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-06-02 08:00:04 2026-09-02 15:45:06 malicious-activity
Agent Tesla ThreatFox Abuse.ch 2024-06-02 17:13:38 2024-06-04 16:20:22 S0331 Agent Tesla

Tags

evasive windows-server-utility win.agent_tesla agentesla agenttesla negasteal

Sample information

Filenames
8058fdac57a403fa90c6b7d69567bbc0a829599a8e93543cc2e51f9177becb24, Remittance Advice.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
673792 bytes
MD5
559f3cab0509194acf2da1d3ab633280
SHA-1
cb754e1ec8656382aa99e4c80f431d359bdeab20
SHA-256
8058fdac57a403fa90c6b7d69567bbc0a829599a8e93543cc2e51f9177becb24
First indexed
2024-06-02 07:43:54
Last updated
2026-09-02 15:45:07

Antivirus detections

EngineDetection
ALYacGen:Variant.Barys.28265
APEXMalicious
AhnLab-V3Malware/Win.Generic.C5628775
ArcabitTrojan.Barys.D6E69
BitDefenderGen:Variant.Barys.28265
BkavW32.AIDetectMalware.CS
CrowdStrikewin/malicious_confidence_100% (D)
Cybereasonmalicious.b05091
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.Packed2.46843
ESET-NOD32a variant of MSIL/GenKryptik.GYFZ
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Barys.28265 (B)
FireEyeGen:Variant.Barys.28265
FortinetMSIL/GenKryptik.FQQD!tr
GDataGen:Variant.Barys.28265
GoogleDetected
KasperskyHEUR:Trojan.MSIL.Crypt.gen
MAXmalware (ai score=88)
MalwarebytesMalware.AI.3791084380
MaxSecureTrojan.Malware.300983.susgen
McAfeeDti!8058FDAC57A4
MicroWorld-eScanGen:Variant.Barys.28265
MicrosoftTrojan:Win32/Wacatac.B!ml
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.jc
SophosTroj/Krypt-ABH
SymantecScr.Malcode!gdn33
Trapminesuspicious.low.ml.score
VBA32TrojanLoader.MSIL.DaVinci.Heur
VIPREGen:Variant.Barys.28265
VaristW32/MSIL_Kryptik.LAH.gen!Eldorado
VirITTrojan.Win32.MSIL_Heur.A
ZoneAlarmHEUR:Trojan.MSIL.Crypt.gen

Network contacts

172.67.74.152 104.26.12.205

DNS requests

api.ipify.org

Process list

NameCommand line
RemittanceAdvice.exe
RemittanceAdvice.exe
RemittanceAdvice.exe
RemittanceAdvice.exe
RemittanceAdvice.exe