MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53e79aafb56c2a49cfa32cf3263f8f8d37ea051af35ff6965c1d12b7ab382f4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53e79aafb56c2a49cfa32cf3263f8f8d37ea051af35ff6965c1d12b7ab382f4a
SHA3-384 hash: 3c6d35aec50f57c6d695b1f74ba87f96325e0773e10252e15724d047878340a9fd19030b5f5b2fe76017b900c2176e63
SHA1 hash: 73b860a24675c03be009cea737df511da418055a
MD5 hash: a9401e103e657260a8a6a405e70af588
humanhash: eight-oscar-autumn-batman
File name:Purchase Order #17032021688776587757865776-pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:488'247 bytes
First seen:2021-03-17 06:41:39 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:ccN8s6Nr6GdQgRksrkxmQ1mEXuwaaBg2a:c0oN+GNPrkxm6mH5aBna
TLSH 47A423B2706CB33642BE55C1068F7A9A5C8C17FEE9F02BD5E57111D2A321341BCA70A7
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""KROGER GROUP CO. LTD" <purchasemg@krogergroup.com>" (likely spoofed)
Received: "from qproxy4-pub.mail.unifiedlayer.com (qproxy4-pub.mail.unifiedlayer.com [66.147.248.250]) "
Date: "Wed, 17 Mar 2021 10:30:05 +0530"
Subject: "Urgent Purchase Order"
Attachment: "Purchase Order #17032021688776587757865776-pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.29088.18241.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53e79aafb56c2a49cfa32cf3263f8f8d37ea051af35ff6965c1d12b7ab382f4a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-17 06:42:07 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kptzvl5vnqvett5dftzsmp4pru36ubi26np7nfs4dujlpkzyf5fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53e79aafb56c2a49cfa32cf3263f8f8d37ea051af35ff6965c1d12b7ab382f4a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 53e79aafb56c2a49cfa32cf3263f8f8d37ea051af35ff6965c1d12b7ab382f4a

(this sample)

AgentTesla

Executable exe 5f9a10a2caebb78a305800c2fd28d3a4a9387a5415df54fbfebf26e2150997a7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f9a10a2caebb78a305800c2fd28d3a4a9387a5415df54fbfebf26e2150997a7
  
Dropping
AgentTesla

Comments