MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f3e0b955a3680e22ead8dedddb983423d908c17e93b0ed5cc2c81be1d5fa2cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f3e0b955a3680e22ead8dedddb983423d908c17e93b0ed5cc2c81be1d5fa2cf
SHA3-384 hash: c67a711c340f23fe08536639da2780ada1fe9b906721e93be973649350df91ab3d931a5b92579a7f1e30b4c05d90478d
SHA1 hash: 3560d3ead17492ad5ef0652d37da520c43cc2fff
MD5 hash: dd01195c2b884cce810d652573730410
humanhash: washington-fish-enemy-virginia
File name:返回提示_ 28072020 _ [REF0000360261].cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:513'911 bytes
First seen:2020-07-31 05:58:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:vEYYQkqPC6bij50m5zTw1uJAJRHGoxVMKbHQa8kRWHmxHP:vpgsLOj50izIu+HXVHCHmFP
TLSH D1B4230BEC08FD6840B39FD6FE196ACE3E397E603B9D4941500795F5B4174A7E2A898C
Reporter abuse_ch
Tags:AgentTesla cab CHN geo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s01.citgrup.ro
Sending IP: 185.104.182.45
From: Oka Ryoichi <marketing@citgrup.ro>
Subject: RE：发票声明付款[REF0000360261]
Attachment: 返回提示_ 28072020 _ [REF0000360261].cab (contains "返回提示_ 28072020 _ [REF0000360261].exe")

AgentTesla SMTP exfil server:
smtp.dachanq.cc:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f3e0b955a3680e22ead8dedddb983423d908c17e93b0ed5cc2c81be1d5fa2cf/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 05:52:17 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l47axfk2g2aoelvnrxw53omdii6zbdax5e5q5vomfsa34hk7ulhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5f3e0b955a3680e22ead8dedddb983423d908c17e93b0ed5cc2c81be1d5fa2cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5f3e0b955a3680e22ead8dedddb983423d908c17e93b0ed5cc2c81be1d5fa2cf

(this sample)

AgentTesla

Executable exe 1fafadae2db218051fb1b353ac4682f0b5fc71e757c3fe094315a7127e94a091

  
Dropping
MD5 c8deca22ffcce8d8e91978fe284304d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1fafadae2db218051fb1b353ac4682f0b5fc71e757c3fe094315a7127e94a091

Comments