MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bf05ad8ca00aaebaa17bfe39b8099148b0b3e1e96bab4360831c5e20c5e315c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5bf05ad8ca00aaebaa17bfe39b8099148b0b3e1e96bab4360831c5e20c5e315c
SHA3-384 hash: 0865d0f7548d24a8740d7a4d7ae7e592f32d0f5520a29ed3527bea80d00f5f44fc7d5bbe6113d6368e492624b8254485
SHA1 hash: 943da2ece25b7e0521c1aa030f2e43403b162ab1
MD5 hash: a0c1b223ff193a92a2474b24b1c30a41
humanhash: ohio-lemon-autumn-carolina
File name:Order CIE-1506-2020 Enq 63-29-2 ABC_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:391'268 bytes
First seen:2020-06-15 13:19:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:WlX9dkSSBaKC0on7cZV4g8W7ti9MUm2LAZgkqLwQ12LV5JzsoDzcenDpnzJz5IZb:cNfSQN0on4ZvRUfLMXY2LV3zsoPrNz5+
TLSH FE8423F3494920587D212678065665E070DAEC9DCCA7B890F4B49BEB07FC3DD78AF066
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 45-138-132-30.derakhshanrah.com
Sending IP: 45.138.132.30
From: Jeremy Donovan-SALES 01 <sales01@mrocompparts.com>
Reply-To: Jeremy Donovan-SALES 01 <soomla6384@yahoo.com>
Subject: URGENT PURCHASE ORDER AND INQUIRY
Attachment: Order CIE-1506-2020 Enq 63-29-2 ABC_pdf.rar (contains "Order CIE-1506-2020 (Enq 63-29-2 ABC)_pdf.exe")

AgentTesla SMTP exfil server:
mail.citotest.co:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-06-15 13:21:05 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lpyfvwgkacvoxkqxx7rzxaezcsfqwpq6s25linqighc6edc6gfoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5bf05ad8ca00aaebaa17bfe39b8099148b0b3e1e96bab4360831c5e20c5e315c

(this sample)

AgentTesla

Executable exe e979370117b602c163e139348aed5cde369c8e25306d374caff010c537ecceb7

  
Dropping
MD5 36cef028fce1401248abf77ef0b476ee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e979370117b602c163e139348aed5cde369c8e25306d374caff010c537ecceb7

Comments