MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fa733a135da85764fbbc9afd3630df30bd97176d237f689171e79787e5f63e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fa733a135da85764fbbc9afd3630df30bd97176d237f689171e79787e5f63e3
SHA3-384 hash: 23ebc618a06b2b35a964e04b66a8438575441ce748587cb6d2baeeb4c57705e7ad7c8411776df88a1232b6c7e743daf5
SHA1 hash: 117feaeda6ec97e1750ede67e1eb2d3a609e4451
MD5 hash: fc1a746d482104c73544f9856433095a
humanhash: lamp-tennis-freddie-oven
File name:invoice copy.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:478'198 bytes
First seen:2020-07-09 08:03:49 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:2EruQ/+YUOZNHQTwozTSPvlnDaYLz2nub:2wz/pUO/QwoviNvLhb
TLSH 1EA4236E31A0A7F3930D1DDDDDE7649F4D3BBA9994E4BAB051E284660140FB81CF89C2
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: yandex.ru
Sending IP: 95.211.208.58
From: Josh Morris<ac.general@yandex.ru>
Subject: FWD:Wire transfer (20SMX0701006N/20SMX0701007N)
Attachment: invoice copy.pdf.z (contains "invoice copy.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fa733a135da85764fbbc9afd3630df30bd97176d237f689171e79787e5f63e3/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 08:05:06 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6tthijv3kcxmt53zgx5gyyn6mf5s4lw2i37ncixdz4xq7s7mprq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 5fa733a135da85764fbbc9afd3630df30bd97176d237f689171e79787e5f63e3

(this sample)

AgentTesla

Executable exe 61b6252c6e94348dfb52432de874d4784801bbf11016af055d2b625c1ec65463

  
Dropping
MD5 2edd8dec034997eaaaec39c5fd672253
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61b6252c6e94348dfb52432de874d4784801bbf11016af055d2b625c1ec65463

Comments