MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5734993184d4886af15b4b4b8e477f45a17de30e9e91121f50fe95db9bf8a22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5734993184d4886af15b4b4b8e477f45a17de30e9e91121f50fe95db9bf8a22
SHA3-384 hash: 1e2b481e5ac8d7c8efe9314241360b978bcc14f07a7f87120b885368f6143d76135b553d75c07140bcc370f9d532dc78
SHA1 hash: 177a967a139037f7357e8f49374fb8b0bf8caa3c
MD5 hash: 6b1dc1daabaf1d8226ac57fc2b6b7416
humanhash: sink-ink-moon-timing
File name:Payment Advice - e-AdviceRefBIBA862005676.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:668'529 bytes
First seen:2020-07-20 08:54:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:UE3O/SQCL+TTbwGApHvi+lt5IR2eh8CEGz6qodyqk4K8MtgqgoDU:vdNCbivteR2eyC76KzEMMoDU
TLSH 6FE4238285C9872EC396513FCBDBE14BF661D8D5FDAAD827068CDCFB016C53A926018D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudmail.nylect.com
Sending IP: 103.254.255.182
From: Kevin Pearson, President | Banksia Landscape, Inc <toh.tg@nylect.com>
Subject: FW: Payment Advice - e-Advice Ref:[BIBA862005676]
Attachment: Payment Advice - e-Advice RefBIBA862005676.zip (contains "Payment Advice - e-Advice Ref[BIBA862005676].exe")

AgentTesla SMTP exfil server:
smtp.borlk.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20774.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5734993184d4886af15b4b4b8e477f45a17de30e9e91121f50fe95db9bf8a22/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:56:06 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vzuteyyjveinlyvws2lrzdx6rnbpxrq5hurcipvb7uv3on7rira._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f5734993184d4886af15b4b4b8e477f45a17de30e9e91121f50fe95db9bf8a22

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f5734993184d4886af15b4b4b8e477f45a17de30e9e91121f50fe95db9bf8a22

(this sample)

AgentTesla

Executable exe 715de4488b8f1a697672312f7a67c075c982d3a14cf2614dfb549b995dc34cbb

  
Dropping
MD5 f35c2dfbc6c4d5abccdd98c6e758b5cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 715de4488b8f1a697672312f7a67c075c982d3a14cf2614dfb549b995dc34cbb

Comments