MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65083d851227067f3847b380b12a76d68061fe9a03eb48420dcbe1258e49a7c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65083d851227067f3847b380b12a76d68061fe9a03eb48420dcbe1258e49a7c0
SHA3-384 hash: 80526457f6578a218e6fe0054c230e6504053afab745ad45a808910f0a187dd3d8e5dab826f78de138e21b444996fcc8
SHA1 hash: 647aad3bec3741b8ceb124bf9b56364bd9a44685
MD5 hash: 83576430d2ddb9204909af67f5c58044
humanhash: network-lemon-island-ohio
File name:outstanding Invoices 31.05.2020 pdf.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:932'086 bytes
First seen:2020-06-10 11:27:17 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 24576:SHYTtkVih4ezQRffyxkORJ+AJhEk51zH7xxT4Qt4r83fIQ4:LTtmihV0lf9qvc2zbnTP4rL
TLSH 8215333B192D8133C5EDFD80ADDCA1A9E1233501F03AC829DF07DD096666A7A56BB1DC
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpanel2.centrin.net.id
Sending IP: 202.146.241.44
From: jusuf.t <jusuf.t@annoa.ba>
Reply-To: uwalchevrolet218@gmail.com
Subject: Re:account statement with outstanding Invoices
Attachment: outstanding Invoices 31.05.2020 pdf.xz (contains "omg 12.exe")

AgentTesla SMTP exfil server:
mail.rajalakshmi.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:29:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mued3bise4dh6ochwoalcktw22agd7u2apvuqqqnzpqsldsju7aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 65083d851227067f3847b380b12a76d68061fe9a03eb48420dcbe1258e49a7c0

(this sample)

AgentTesla

Executable exe db835b1d8c0cb244f0ee4acc8aa757beab527b257756fa7ff17b2847388545c5

  
Dropping
MD5 2ab4308e7031e2b2ddbb44756f5b8ca9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db835b1d8c0cb244f0ee4acc8aa757beab527b257756fa7ff17b2847388545c5

Comments