MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd91c6358eb5aadf4678a91854dc5821a5a50a69d7e97a579bf343c63e8e17fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd91c6358eb5aadf4678a91854dc5821a5a50a69d7e97a579bf343c63e8e17fd
SHA3-384 hash: 11d78d2660c4b80ba5f30fb7b926651ed14e62df01138923b1627cd1af2bb5c56960387d4c246989e2f4d0cfe24af0ac
SHA1 hash: f55db3e8ae3f624ce50a7c9d4c1c5d1fd67a7c5b
MD5 hash: 6a7ee5b5847eba7aabecaa59c1b56f83
humanhash: monkey-low-kentucky-quiet
File name:3278778949_PDF.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:328'413 bytes
First seen:2020-05-04 20:50:35 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:QlOiioY5B8SIEMWujerhjoPpQpoBT8wjxC+/ptKqvPiloEZ7NSK27MSiEfZQF:Ql5urIWPjOpKW8H+/ptkoE+/MbEk
TLSH E6642306DC28E392F9DCF81BD877A9846CB9DC246BDC05B57A42573301D26CC2A65CBB
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: panel018.areaproject.net
Sending IP: 185.55.249.118
From: Factoring y Confirming - Grupo Santander <fyciout@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 3278778949_PDF.GZ (contains "3278778949_PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 20:30:47 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwi4mnmowwvn6rtyvemfjxcyegs2kctj27uxuv436nb4mpuoc76q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz bd91c6358eb5aadf4678a91854dc5821a5a50a69d7e97a579bf343c63e8e17fd

(this sample)

AgentTesla

Executable exe d4f0ec801c62358eddef6f921ac704593bccd1847f34e6f0272db9f40f74adb0

  
Dropping
MD5 c7f07cd31c8a3a52abc57021a374d37f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d4f0ec801c62358eddef6f921ac704593bccd1847f34e6f0272db9f40f74adb0

Comments