MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5979d11d335b4bed595bcff0cac6f729febd9720fc014466437e90dd51238bae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5979d11d335b4bed595bcff0cac6f729febd9720fc014466437e90dd51238bae
SHA3-384 hash: a67fad684a9d92002fbf32bde60a32f201b5209e3cf8523e44105058a40bbf029239cfc349310235ecc6e3b03ac3610e
SHA1 hash: 87a1f0590f84632e4e529686173b49d214d3b606
MD5 hash: f15bacec6ca7459b6ada5040684d28aa
humanhash: carpet-violet-comet-coffee
File name:shipment documents.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:352'024 bytes
First seen:2020-07-16 08:00:48 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:ittwh0k/WbDPM4W9cYO5yVgmrhVwmfVmLIBFGbtUqM3/h1Nos+JaB:Yti0H/FW9LemrhVwm9mWGbGqI/Nx6aB
TLSH 617423EDCE80659DACE69694247E0C74242BD52028FC5CBE503BBD81AED6F25C3CE15B
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aten.ch-dns.net
Sending IP: 80.74.147.132
From: Prema Kumar <prema.kumar@premed.swiss>
Subject: Draft B/L+ INV+ PL+ COO - for incoming shipment
Attachment: shipment documents.gz (contains "shipment documents.exe")

AgentTesla SMTP exfil server:
smtp.sankapatrol.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5979d11d335b4bed595bcff0cac6f729febd9720fc014466437e90dd51238bae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 08:02:08 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lf45chjtlnf62wk3z7ymvrxxfh7l3fza7qauizsdp2in2ujdroxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5979d11d335b4bed595bcff0cac6f729febd9720fc014466437e90dd51238bae

(this sample)

AgentTesla

Executable exe d9351ce503256f14f917a5cb7adfcdcf07a9364973fc324dc9517d407c6bdd0a

  
Dropping
MD5 4f267c8f0648a52ff6b06816e724949a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9351ce503256f14f917a5cb7adfcdcf07a9364973fc324dc9517d407c6bdd0a

Comments