MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b533c32c03b502308a2276220ef742b4c8d723ecefc5bee59e6cad14f685ec53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b533c32c03b502308a2276220ef742b4c8d723ecefc5bee59e6cad14f685ec53
SHA3-384 hash: 92fa627be6ef4af4e423e24bfad8b3b51e51fc575891305c74dd89c603d82b1201658b1e16545b28f824ec15f30982a2
SHA1 hash: dd2d83f64d31254c9ba6ab5167b02164ae4dd0c6
MD5 hash: a2f5f0561ddb1fe576f1174b0cef526e
humanhash: victor-whiskey-october-may
File name:Invoice PI54738 - Packing list PL@03293.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'668 bytes
First seen:2020-08-03 07:44:31 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:Vp+5DQOXWGd77PPuoogI+sn8UW2XEfIxon1wqIpeoJSoxkjCY8:ViD5zx7fI+sn8MEfIxon1Ldzh8
TLSH 20A423E14F00CCEB69E775A49CAAE5C5890A08498D77C6EC735487DA43F7F624CA6232
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bluehouseentp.com
Sending IP: 95.211.208.25
From: Asad Dhanraj <asad@bluehouseentp.com>
Subject: Re: invoice & packing list
Attachment: Invoice PI54738 - Packing list PL@03293.pdf.gz (contains "Invoice PI#54738 - Packing list PL@03293.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b533c32c03b502308a2276220ef742b4c8d723ecefc5bee59e6cad14f685ec53/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 07:46:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuz4gladwubdbcrcoyra552cwtenoi7m57c35zm6nswrj5uf5rjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b533c32c03b502308a2276220ef742b4c8d723ecefc5bee59e6cad14f685ec53

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b533c32c03b502308a2276220ef742b4c8d723ecefc5bee59e6cad14f685ec53

(this sample)

AgentTesla

Executable exe 528d0007809c7002553af6f0e778ecd2ea005b446263a226fe8857d163d2c7a8

  
Dropping
MD5 b6bdfdc433ab027c16774c91755af5db
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 528d0007809c7002553af6f0e778ecd2ea005b446263a226fe8857d163d2c7a8

Comments