MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 538f69168eb49a3e7fe6f6d4806b4b2dab9a1bf3f79f96442a999c5a55b5b0b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 538f69168eb49a3e7fe6f6d4806b4b2dab9a1bf3f79f96442a999c5a55b5b0b5
SHA3-384 hash: af7c92d30eb4742299281c51accd5487722722a9252c96b507325394bc2e83bb5ae945dd1122b0fbd2393ea927c6e3b3
SHA1 hash: 96a55d70d4064495916f4406d0f53056a4e1975d
MD5 hash: 645752ce0ae161b10e9cebd5f79f2ca8
humanhash: eleven-early-india-mockingbird
File name:URGENT SUPPLY (RFQ REF R2100131410).pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'968 bytes
First seen:2020-06-08 05:44:41 UTC
Last seen:2020-06-08 05:49:56 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:6XrBAaPkYBPtnMS/azXetozI+8t38ZZevfKdWom:6XmaPkrJbemzI+43C1dzm
TLSH E29423D15DDAB7467DC69A815E36C344A8B01BF76ACE73E0049BF8FC3D9BA072610891
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Rick Ching <info@xingfa.com>
Received: from xingfa.com (unknown [78.129.132.154])
Date: 8 Jun 2020 06:45:41 +0100
Subject: URGENT SUPPLY (RFQ REF : R2100131410)
Attachment: URGENT SUPPLY (RFQ REF R2100131410).pdf.gz

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200609-0823.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:46:08 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kohwsfuowsnd477g63kia22lfwvzug7t66pzmrbktgofuvnvwc2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 538f69168eb49a3e7fe6f6d4806b4b2dab9a1bf3f79f96442a999c5a55b5b0b5

(this sample)

AgentTesla

Executable exe 85da156a6a3f7183f64066a1cabc2adf61ff011834f81495e52bdc2cbc047965

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85da156a6a3f7183f64066a1cabc2adf61ff011834f81495e52bdc2cbc047965
  
Dropping
AgentTesla

Comments