MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c2afec95e5c8986d5ef1f635ab651f64411d0ee8bcdf199c35fbc3f586efbee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c2afec95e5c8986d5ef1f635ab651f64411d0ee8bcdf199c35fbc3f586efbee
SHA3-384 hash: 946f480faecf0c02062e8d816107957237cd3c41afbad8f87106da7223dbe1eddaea25fb50d00dab8bcef00b2a073735
SHA1 hash: 315fc300114f8a56f5468812c304febd74f5f28a
MD5 hash: cb106fc89d66028f885c9eb80f6bad65
humanhash: four-august-finch-eighteen
File name:Payment Request - invoice G3181992 200126-008251...pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'873 bytes
First seen:2020-06-10 07:06:34 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:C78O7T71CzioDrSGKot50UYQ9w7f04BYiAu:s8KdINPSQEQU2il
TLSH AD9423002479585E8325DDD35789E4606A4B9F8AD17272603FF63E4C4ADE7BB4BBBB00
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: hameedentr@cyber.net.pk
Subject: Payment Request - invoice G3181992 [200126-008251] PAYMENT,
Attachment: Payment Request - invoice G3181992 200126-008251...pdf.gz (contains "Payment Request - invoice G3181992 [200126-008251].exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:08:06 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lqvp5sk6lseynvppd5rvvnsr6zcbduhorpg7dgodl66d6wdo7pxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5c2afec95e5c8986d5ef1f635ab651f64411d0ee8bcdf199c35fbc3f586efbee

(this sample)

AgentTesla

Executable exe cc75bdcebd9658c79051c35083b71ba78672538a14d34ab0d1f396c6b1c4ea69

  
Dropping
MD5 af7e58562b19323153abd6a02b8d70ed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc75bdcebd9658c79051c35083b71ba78672538a14d34ab0d1f396c6b1c4ea69

Comments