MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f388f0b623ac4d65e9dcfd53f2139df2660f0885de0056280cf9a3377567692. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f388f0b623ac4d65e9dcfd53f2139df2660f0885de0056280cf9a3377567692
SHA3-384 hash: 9dd3876f33cdc2e034a8ea53efc37657e122c6f1c0c8592a08fc4d96e39b153915271d7617000a0d2fcc350d0802f731
SHA1 hash: da27e773556382a88253ec8542f88aecaa01c6ac
MD5 hash: ad472a8e67994c75ddaafd52c5320bcf
humanhash: oven-carolina-two-cat
File name:HSBCSWIFT ADVICE_0069700S.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'949 bytes
First seen:2020-06-19 06:09:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fmSEf17ywAAqzqGQTiy+CN4cCjnRqCki3lJBXMVTMQ7fr47cnHuXTymGeMu5s7:OzkJzDQgCN4cCjRCi1JBXNQPecIyoa7
TLSH 579423EB81FC8B4309FE7B1E6C49548D55C3555BE893E6F626708B2923D1E1A9CC2F02
Reporter abuse_ch
Tags:AgentTesla HSBC z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ihg.com
Sending IP: 95.211.208.25
From: Sales Manager <sales07@ihg.com>
Subject: FW: HSBCSWIFT ADVICE_0069700S
Attachment: HSBCSWIFT ADVICE_0069700S.pdf.z (contains "HSBCSWIFT ADVICE_0069700S.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.16455.31646.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 06:11:03 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l44i6c3chlcnmxu5z7kt6ijz34tgb4eilxqakyuaz6ndg52wo2ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5f388f0b623ac4d65e9dcfd53f2139df2660f0885de0056280cf9a3377567692

(this sample)

AgentTesla

Executable exe cece70f17744f2265c782f7c03a52c6a6056f5048e21178136808b41a3e026cf

  
Dropping
MD5 b7d9594d4cf6b50b788375730dea6ade
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cece70f17744f2265c782f7c03a52c6a6056f5048e21178136808b41a3e026cf

Comments