MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5599f6d70520b45ad1193768c3e0a86f48e0fb124ba546af0af3fb0c8182f6dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5599f6d70520b45ad1193768c3e0a86f48e0fb124ba546af0af3fb0c8182f6dd
SHA3-384 hash: 52247f0b793e0bb03f09638ebaea37882aa48388fc92a52ee5417711a32ad481b8abf361e4bd8ce1510ba911d85251d2
SHA1 hash: ba56ecca29e2cd6398e7fb589cac5d1030c4f17f
MD5 hash: 59edefa283a1967a6c9269942822bb3e
humanhash: chicken-kitten-fish-chicken
File name:factura de reembolso_274982_copia.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:421'507 bytes
First seen:2020-07-29 10:58:09 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:RRDknNy99W3XF4pHsyB3O1hbATIpJ1O19o6dicG5ie6UqW3uTU57w0WEJKS+n2:RRDd6ypd+g8/ShRe8K/7wPx2
TLSH 069423E461BE07408DEEBEFC09D57BBCA4F19BA3AD9CA03307695A909677D642C443D0
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.deliveriies.com
Sending IP: 146.71.78.63
From: Impuestum Contadores S.A. <impuestumcontadores_s.a@prodi.gob.com>
Subject: Estimado Ciudadano / No Inmigrante
Attachment: factura de reembolso_274982_copia.pdf.z (contains "factura de reembolso_274982_copia.pdf.exe")

AgentTesla SMTP exfil server:
mail.centinelaperu.com.pe:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5599f6d70520b45ad1193768c3e0a86f48e0fb124ba546af0af3fb0c8182f6dd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:40:42 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kwm7nvyfec2fvuizg5umhyfin5eob6ysjosunlyk6p5qzamc63oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5599f6d70520b45ad1193768c3e0a86f48e0fb124ba546af0af3fb0c8182f6dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 5599f6d70520b45ad1193768c3e0a86f48e0fb124ba546af0af3fb0c8182f6dd

(this sample)

AgentTesla

Executable exe 1a5d841876ef1e6ad5a9ff4ff4f8d23687e2e80d62f1386fde805a8653110d98

  
Dropping
MD5 a8ae8c4c3d4289178fc6b671222fd9ed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1a5d841876ef1e6ad5a9ff4ff4f8d23687e2e80d62f1386fde805a8653110d98

Comments