MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e10376ec9333074d1fb14c4e166c8d71a22f31ea3811516dfa50cfdc170de3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e10376ec9333074d1fb14c4e166c8d71a22f31ea3811516dfa50cfdc170de3b
SHA3-384 hash: e6b5f0a8ab576d6737223573a222d8b7d333e4d6afdd4799674f081b20ec8c445b755d28daf372e34d9fec9f44516e97
SHA1 hash: b9f313f032160d42f91580363fa39c1206e97e07
MD5 hash: 58719d54d40eae4ce23ea6293d1c5908
humanhash: oven-illinois-white-three
File name:payment.XZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'061'586 bytes
First seen:2020-05-12 15:12:28 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 24576:TFKuf1nruK691BM+yCQSClo5jVPLsBv3hqm/HEruDrJxNFPlN:RK0ruKs1npco5jFEvhtyuD9PN
TLSH B935332E8E05C6AD022975930F47D5B47B0FD2691F7A2440612FF1B8FC4B95D3638BAA
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: winpro1.internet-webhosting.com
Sending IP: 103.8.24.77
From: <hr@megamart.com.my>
Subject: FW: PAYMENT
Attachment: payment.XZ (contains "payment.exe")

AgentTesla SMTP exfil server:
mail.elsewedyindustrial.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 15:35:56 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyido3wjgmyhjup3ctcoczwi24ncf4y6uoarkfw7uugp3qlq3y5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 5e10376ec9333074d1fb14c4e166c8d71a22f31ea3811516dfa50cfdc170de3b

(this sample)

AgentTesla

Executable exe f48fadaef41e4ea454e0325f4f7bdfce964431c54ec8f623c1e34140d4f4dc78

  
Dropping
MD5 b406295b7ec6cac8dcad0b1c6e81c769
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f48fadaef41e4ea454e0325f4f7bdfce964431c54ec8f623c1e34140d4f4dc78

Comments