MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c180bb2fd08f9b3c8e00c928da85e5fa814873048bd60ed20562413332c06e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c180bb2fd08f9b3c8e00c928da85e5fa814873048bd60ed20562413332c06e6
SHA3-384 hash: 38f58ff45d3f48c91ca928d90608a8bbde81a2c79c9631383908dc098276baf27b0875997c50773f322ab8bd6cc14930
SHA1 hash: 79f6a474b876ac1977308a7cd65bc9b353764243
MD5 hash: b09b5d097d33f5016e25d19e889cfd2d
humanhash: fanta-montana-kitten-sad
File name:P.O 28602 21256......pdf.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'254'239 bytes
First seen:2020-05-20 12:22:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:prqS8G0+JcLNoqKqKdWRaeTidZm6oEbo5LdwyZI:AZswNoqKq0EiLmxpLdwyZI
TLSH 494533EF2284DE6EA324BFB79CD4F2909D4983E8399565B842C00B32E346737665472D
Reporter abuse_ch
Tags:AgentTesla r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rujaapparels.com
Sending IP: 45.11.19.32
From: Info <jakir@rujaapparels.com>
Subject: Amended P.O 28602 / 21256 Hebei Ocean
Attachment: P.O 28602 21256......pdf.r11 (contains "P.O 21256......pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:37:23 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lqmaxmx5bd43hshabsji3kc6l6ubjbzqjc6wb3jakysbgmzma3ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5c180bb2fd08f9b3c8e00c928da85e5fa814873048bd60ed20562413332c06e6

(this sample)

AgentTesla

Executable exe 0cd06914b595400bf60a7d8f44c4ff7c2b25efdd581ef8f8503e160837334e6a

  
Dropping
MD5 91dc48e65442b91dfdb9dc74bf70634b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0cd06914b595400bf60a7d8f44c4ff7c2b25efdd581ef8f8503e160837334e6a

Comments