MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a4655bcc15c9999642ef7f83517950f85a2938fb845f6d261533b70a0357dda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a4655bcc15c9999642ef7f83517950f85a2938fb845f6d261533b70a0357dda
SHA3-384 hash: 2622cda24e7bf57d6f8a591ed60a8dca9665d44bb6eaa77cf555a4660c029c310ba768599e4105b7a0b1f8fab1cafe2f
SHA1 hash: 81b61441b6c81a2aa450ec511ae0c471f5d05212
MD5 hash: 64ff7896741000b9525e956dfabab685
humanhash: item-yellow-twelve-football
File name:Payment Notification_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'769'472 bytes
First seen:2020-12-01 13:06:40 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:JzXz/RzgfF+UsUVXWlWEyGwhnvYGLLEkft5:N83VuZMvrL
TLSH F585DFF2ED07E958D12608F4D48ED24C9D55EF4B0B6A9C06BA08F3496A7760CDEC89F1
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Paymentsemail@fnb.co.za" (likely spoofed)
Received: "from webserver.capricorn-it.co.za (webserver.capricorn-it.co.za [41.0.5.199]) "
Date: "Tue, 01 Dec 2020 13:11:52 +0200"
Subject: "Payment Notification from OUPA WILSON MASHIMBYE_M9QP86YG"
Attachment: "Payment Notification_pdf.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.29121.17129.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a4655bcc15c9999642ef7f83517950f85a2938fb845f6d261533b70a0357dda/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-01 13:07:08 UTC
File Type:
Binary (Archive)
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljdflpgblsmzszbo674dkf4vb6c2fe4pxbc7nutbkm5xbibvpxna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a4655bcc15c9999642ef7f83517950f85a2938fb845f6d261533b70a0357dda

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 5a4655bcc15c9999642ef7f83517950f85a2938fb845f6d261533b70a0357dda

(this sample)

AgentTesla

Executable exe 7f802df495b44e3cf25953672257f08a969abbed49958bcbefca59baaa40fcaa

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f802df495b44e3cf25953672257f08a969abbed49958bcbefca59baaa40fcaa

Comments