MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cac33596ed310b177e3d63fd7338a2cdf1140693c3d63f79c0fa1cf568a5a0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cac33596ed310b177e3d63fd7338a2cdf1140693c3d63f79c0fa1cf568a5a0d
SHA3-384 hash: 5537e0102c9148cd8d2960efe570b3414f3aa11066b5a90841ee9cc10a5d38f6622b3ddc2eba76c7390b91b8f67cce24
SHA1 hash: 1d75af4c865b9c456c8656dd959859c40e1fb6af
MD5 hash: 1ef7a2b5cd54d32eaea031de2966b747
humanhash: massachusetts-enemy-king-lamp
File name:Invoice Copies, Original Shipping documents, and BL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:794'414 bytes
First seen:2020-05-19 07:16:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Zin2xPt6PNGyXn+0O4hin2xPt6PNGyXn+0O4e:An86PNx3+0O44n86PNx3+0O4e
TLSH CBF423C922893455EDB0FECF3589497243FC4DA8370BB698BEF55D3389B00E96A5D908
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aanhga.com
Sending IP: 80.85.157.63
From: DHL Express Delivery <expressdelivery@dhl.com>
Reply-To: DHL Express - Felix Muller <felixmuller.dhl@mail.com>
Subject: Fw: NEW SHIPMENT NOTIFICATION: INVOICE COPIES, SHIPPING DOCUMENTS & BL; AWB NUMBER - 426129487
Attachment: Invoice Copies, Original Shipping documents, and BL.rar (contains "Invoice Copies, Original Shipping documents, and BL.exe")

AgentTesla SMTP exfil server:
mail.alvadiwipa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 07:36:13 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lswdgwlo2milc57d2y75om4kftprcqdjhq6wh544b6q46vukligq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5cac33596ed310b177e3d63fd7338a2cdf1140693c3d63f79c0fa1cf568a5a0d

(this sample)

AgentTesla

Executable exe f8b881049eff27232d360fb3a623e75ff7504b4da918cbd6666c917ddb38ef73

  
Dropping
MD5 4a5ec0c98a82267276af25b93197846b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8b881049eff27232d360fb3a623e75ff7504b4da918cbd6666c917ddb38ef73

Comments