MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aa97979ab789efb3792aeae47306687c79fcb30104072d4da48a2c0fc89fac3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aa97979ab789efb3792aeae47306687c79fcb30104072d4da48a2c0fc89fac3
SHA3-384 hash: cacc10bacc6f177cfb9e76d894e271e503b4b040a04b8955e21cce4dccab3c8631b07919955362a772a8841a7c44c425
SHA1 hash: 62cc9787c98f6abb3a661462c9f70b5334f34f9f
MD5 hash: d7d06b594e0c78f51c5bafd9404f1250
humanhash: finch-diet-golf-romeo
File name:Payment Advice.tar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:618'811 bytes
First seen:2020-08-18 13:12:21 UTC
Last seen:Never
File type: tar
MIME type:application/x-rar
ssdeep 12288:EX859MBZNeBkdHJ8T/dl9m7QOeqlVExLqGN1wITz0Ncubks3090nyNeUIG:Ek9MrNtdId/msOeqjHCZryD30uA9
TLSH 62D42369DCA4422E9B87940F75DD416B6294E3C50B1E9506C44AA3BC33D9EBEF3C83D4
Reporter abuse_ch
Tags:AgentTesla HSBC tar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: swn0.zazomika.ga
Sending IP: 68.183.67.246
From: HSBC Advising Service <customerservice@hsbc.com.hk>
Subject: Payment Advice - Advice Ref:[GLV7179483966] / Priority payment / Customer Ref:[ tinaxie940200]
Attachment: Payment Advice.tar (contains "Payment Advice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5aa97979ab789efb3792aeae47306687c79fcb30104072d4da48a2c0fc89fac3/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:14:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkuxs6nlpcppwn4sv2xeomdgq7dz7szqcbahfvg2jcrmb7ej7lbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5aa97979ab789efb3792aeae47306687c79fcb30104072d4da48a2c0fc89fac3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 5aa97979ab789efb3792aeae47306687c79fcb30104072d4da48a2c0fc89fac3

(this sample)

AgentTesla

Executable exe 304e78de51ea65e0509fadcfb74df410c181ee7ce02a24cec6d4cf7e1055651d

  
Dropping
MD5 5586a9d6dfad896814a25f4f50c85ad2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 304e78de51ea65e0509fadcfb74df410c181ee7ce02a24cec6d4cf7e1055651d

Comments