MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5add4a158571a8887b3dc1380b5407baa663949fe76cda1ac642eeb53e6bf44f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5add4a158571a8887b3dc1380b5407baa663949fe76cda1ac642eeb53e6bf44f
SHA3-384 hash: 5570fa51881e4b1f85148312accdb84603953958fed460cf9d4a7056a18fb953e5110a05c926f8c804150641bea70b99
SHA1 hash: 1690049b8942c3cb45d6a880dbcc49c441e2606c
MD5 hash: a40dbb382292c03fc91c71e152dde1ea
humanhash: aspen-high-maryland-delaware
File name:document.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'096'993 bytes
First seen:2020-05-26 10:15:03 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:JvkNHCDHAzch9HUv9KRSh8BfSeOKJPYrDcxa:pkNHcHAzcrm9KRSh+uKMv
TLSH B63533092C064A9FB194DF7F2164CCC2E87F861FA43DA5CA511E96ABF3CDB31B190619
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blulogistics.cn
Sending IP: 156.96.58.98
From: Jacky Zhang <Jacky.zhang.xmn@blulogistics.cn>
Reply-To: Jacky.zhang.xmn@blulogistics.cn
Subject: This is urgent!
Attachment: document.pdf.gz (contains "document.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:26:36 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
16 of 30 (53.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5add4a158571a8887b3dc1380b5407baa663949fe76cda1ac642eeb53e6bf44f

(this sample)

AgentTesla

Executable exe 4866525533264a3c6a8ff2492e5090f90e0985cb3217a329b25607864ad97683

  
Dropping
MD5 5bbb03edb7979cce2b37c04facdbca9a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4866525533264a3c6a8ff2492e5090f90e0985cb3217a329b25607864ad97683

Comments