MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5f9c8d806d0d05cf81ed85e5471d73afa102ba5f508178aff54e7f2ad3c8c48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5f9c8d806d0d05cf81ed85e5471d73afa102ba5f508178aff54e7f2ad3c8c48
SHA3-384 hash: 358787d71279aa58b7b5c13c5e6893be4c19f9ec6a8d4816e976f1bc1b66d92db6e3f65d23477f104a2943a95f841880
SHA1 hash: f77a51cebecc1f23948716f4bdb534d1ef86a34c
MD5 hash: 5eb8854f1552206ed1faf5949bc87318
humanhash: apart-oscar-alpha-venus
File name:cotización.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'109 bytes
First seen:2020-08-05 15:37:46 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:1wQw40CgniNqf2mYjr1c0rIvKozKfVG4Jw:mQwlCgiG2mghc0NuKfVG4Jw
TLSH 3494235C9949C0F8A16E3AB5943194E37DFE31FAE1132F0ED2E797046C768E9041E7A2
Reporter abuse_ch
Tags:AgentTesla ESP geo gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.viteltek.com
Sending IP: 45.79.51.124
From: admon <fresnillo@petroseal.com.mx>
Subject: Re: Muy urgente Nueva consulta orden de cotización#0032
Attachment: cotización.pdf.gz (contains "cotización.pdf.exe")

AgentTesla SMTP exfil server:
mail.trademaxperu.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5f9c8d806d0d05cf81ed85e5471d73afa102ba5f508178aff54e7f2ad3c8c48/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 15:39:05 UTC
AV detection:
15 of 27 (55.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wx44rwag2difz6a63bpfi4oxhl5bak5f6uebpcx7ktt7flj4rrea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b5f9c8d806d0d05cf81ed85e5471d73afa102ba5f508178aff54e7f2ad3c8c48

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b5f9c8d806d0d05cf81ed85e5471d73afa102ba5f508178aff54e7f2ad3c8c48

(this sample)

AgentTesla

Executable exe 968bef9303261890912cbde7737195a73c2d8892457c3cc8a327008effb4e8c9

  
Dropping
MD5 553a2913e4cd6813054c5099dc353eeb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 968bef9303261890912cbde7737195a73c2d8892457c3cc8a327008effb4e8c9

Comments