MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 117fac29259144eea01437fba5a89e49c773b1d5184c42f3a3735e8d7045f7e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 117fac29259144eea01437fba5a89e49c773b1d5184c42f3a3735e8d7045f7e4
SHA3-384 hash: 6adf17a16442543c6de0ef0450daf7423ecc50eb14019812dafcbd07dd5cb4c60555e1cec51e01645340d9629f70b4bc
SHA1 hash: 261d11b8eb8b99aca2b82cb4fe8d4a53fc2e8562
MD5 hash: 954d11e7a5e8ebdc131ea7c6f6aee3a2
humanhash: william-ohio-double-charlie
File name:45676576545_pdf.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:383'030 bytes
First seen:2020-05-05 11:01:14 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:JUvIwhosutMbahix8A6ckZp+ht6h6kXb+51JSUB3N791CzEQ036xq9TbEy+HN5mC:OIKAG8iCA6vpo6hbKB3zwzE32qVAvmC
TLSH 868422F6AC4D005F1637A7BAD18FCA88E0B9E52CFB7BA1311DD4712B4B6A06E45B501C
Reporter abuse_ch
Tags:AgentTesla ESP geo gz Santander


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: panel018.areaproject.net
Sending IP: 185.55.249.118
From: Factoring y Confirming - Grupo Santander <fyciout@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 45676576545_pdf.GZ (contains "45676576545_pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 11:36:47 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cf72ykjfsfco5iaug752lke6jhdxhmovdbgef45donpi24cf67sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 117fac29259144eea01437fba5a89e49c773b1d5184c42f3a3735e8d7045f7e4

(this sample)

AgentTesla

Executable exe 8883f73f1e34a42362cd116db607dd2cbf33616249a68783ec6a0455b72d8bcb

  
Dropping
MD5 01bc7d05b6e6507b7017abee3579738a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8883f73f1e34a42362cd116db607dd2cbf33616249a68783ec6a0455b72d8bcb

Comments