MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5022977f425b6215c89d07b2aa54ecd5607c88e79218d42faa1fa410268b8aea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5022977f425b6215c89d07b2aa54ecd5607c88e79218d42faa1fa410268b8aea
SHA3-384 hash: caf7a587a340d0b167994e7e03a41c59f5aee5591b7da514a5bf6aa5289463311726888e3d0015743f0abbac8e7212e0
SHA1 hash: 073ff18e376874fcc4b90dedc60ecf39c34c751b
MD5 hash: d226d5ab4274554e706c490862186ef8
humanhash: white-coffee-alanine-social
File name:BIS.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:369'851 bytes
First seen:2020-06-16 05:07:44 UTC
Last seen:2020-06-16 07:16:38 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:XQLFvdlXA6mjgGLnDRrEeIcZ8XuGJRGEYMqydTX/IWt1JoI5oaydStK0bp6KNahp:iFvDXejgi949cq3R5JdLIunyAtNgK8T9
TLSH A17423A39DE9C01F544BFBF09C5DBD4A6528B642B86284B05FFB7E08A6B14540CB3D87
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: leadsint-logistics.com
Sending IP: 185.222.58.155
From: Leads Business Development <bd@leadsint-logistics.com>
Subject: PAYMENT INV 20-000450 & 000424
Attachment: BIS.GZ (contains "BIS.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:09:04 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=karjo72clnrblse5a6zkuvhm2vqhzchhsimnil5kd6sbajulrlva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5022977f425b6215c89d07b2aa54ecd5607c88e79218d42faa1fa410268b8aea

(this sample)

AgentTesla

Executable exe 20df636881ac1b90a09339824066c137458264e85ac4ce4767a5841a574a9dcc

  
Dropping
MD5 d0fbebabc3420e94945095c1ac4eea53
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20df636881ac1b90a09339824066c137458264e85ac4ce4767a5841a574a9dcc

Comments