MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d2e02d7df210a251f6ae31733450745906b7cc3202bc07444c632e9f716a65b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d2e02d7df210a251f6ae31733450745906b7cc3202bc07444c632e9f716a65b
SHA3-384 hash: d8cbd0541f6643d5dff5c75c1695f9a7403ccf5f08134df68db47359c4a030c58e4746b132f7b16eb7df2ce5f6504078
SHA1 hash: 9f6802969f64870ac3ae913accec441d2956cc52
MD5 hash: 0ccb4729f07b68bba1fca12da75d1812
humanhash: lemon-quebec-xray-finch
File name:LIST OF PRODUCTS NEEDED.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'228 bytes
First seen:2020-06-11 13:47:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ogv5OVaMxn7X8t31RdCzHzpQAM/mJruAFVKP:V0VaMx7MtHgbzGAkm7S
TLSH D79423EB890AF8B2FED99EACCA5FF6C3B1465F0D3E3965E867293257401D06D145C006
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.bandeirantesbauru.com.br
Sending IP: 54.39.179.214
From: Illinois Tool work Inc. <paulanthony4943@gmail.com>
Subject: URGENT NEW PURCHASE ORDER
Attachment: LIST OF PRODUCTS NEEDED.pdf.rar (contains "LIST OF PRODUCTS NEEDED.pdf.exe")

AgentTesla SMTP exfil server:
mail.guddupak.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 13:52:20 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=luxafv67eefckh3k4mltgrihiwigw7gdeav4a5ceyyzot5ywuznq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5d2e02d7df210a251f6ae31733450745906b7cc3202bc07444c632e9f716a65b

(this sample)

AgentTesla

Executable exe cf58610422f4831d446bc2793b1257aa54813d2aa4434491e384d9e4775fd7a2

  
Dropping
MD5 bb79ae389898e25bbad614c6015ade07
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf58610422f4831d446bc2793b1257aa54813d2aa4434491e384d9e4775fd7a2

Comments