MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a394820228d34b9b0a7ecd5e02de5eef77988251a0ba90e17618fee964312e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a394820228d34b9b0a7ecd5e02de5eef77988251a0ba90e17618fee964312e7
SHA3-384 hash: f90709cbaf692dc66d9bc16f582a065ce2cc372a4145743661409d6306d67473fdd1d2564f4e9828daad91e2d8a3588c
SHA1 hash: 9acbfc68aca4343b4752eddcbe9269896d0e2983
MD5 hash: 8c00a22ad035812858244b1181907808
humanhash: cold-uranus-muppet-earth
File name:Pallex PO 884563_ITALY 1
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'371 bytes
First seen:2020-05-26 16:10:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:4sCXv9EGMoVVxQA+KasocNHzhwXRRn85elRERlYdqZHKMOk3NsXtLRfSGVBQ:NU9BjTQAzBrFVwhZ8/lMjc6dNS1
TLSH FA942315167598A91936B2F07E5CB83F310E32BB73B3F4C34EA8887A44691DDE21764E
Reporter abuse_ch
Tags:AgentTesla Pallex PO 884563_ITALY 1


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zimbra207.megavelocity.net
Sending IP: 192.206.6.182
From: support-IN <support@budget1.in>
Subject: Pallex PO 884563_ITALY
Attachment: Pallex PO 884563_ITALY 1 (contains "Order_884773_List.doc.exe")

AgentTesla SMTP exfil server:
premium57.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27215.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 16:36:10 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5a394820228d34b9b0a7ecd5e02de5eef77988251a0ba90e17618fee964312e7

(this sample)

AgentTesla

Executable exe e651957af4c527f8a23f8c3094232c887e2a433974ab54e48e2519e8361809a6

  
Dropping
MD5 0163ac2797196663b91439a473b42751
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e651957af4c527f8a23f8c3094232c887e2a433974ab54e48e2519e8361809a6

Comments