MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cd5fcc2cddac54296f4c79db7e8a2b5464ece383d19d74ffb37a455441639ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cd5fcc2cddac54296f4c79db7e8a2b5464ece383d19d74ffb37a455441639ff
SHA3-384 hash: 5f549b38f63fd54439af26e533b0b85968ba417ed3b2161a6c807db11fadbf83b9d99f7c6f8a4c2c472d0866162417ae
SHA1 hash: 785740efa8676b42ee22a3140bae2a950ae706f0
MD5 hash: d0e4dcc09fe01a109ee7af7b6102d193
humanhash: coffee-kentucky-fanta-oven
File name:SOA_FEBSHIPMENTS.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:345'104 bytes
First seen:2021-03-03 10:50:32 UTC
Last seen:2021-03-05 15:02:31 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:WcOE2RRb8d01gg4pd3kimdaAVX21cs10iaifuQKD1cFs+JRhMNj9bSi9ZmC/tW8j:WcMRRb8a1H4pnmdxVmhaifuQS1ms+JR+
TLSH 0B7423D9866B56D0FDD985D14C6A040DDC37561C3093A8FB137F3AEFCB28861879B688
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5cd5fcc2cddac54296f4c79db7e8a2b5464ece383d19d74ffb37a455441639ff/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 10:51:07 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltk7zqwn3lcuffxuy6o3p2fcwvde5tryhum5ot73g6sfkrawhh7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/5cd5fcc2cddac54296f4c79db7e8a2b5464ece383d19d74ffb37a455441639ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5cd5fcc2cddac54296f4c79db7e8a2b5464ece383d19d74ffb37a455441639ff

(this sample)

AgentTesla

Executable exe 8fd87a74ea9ed9ce7c20c2a2c89f9170e97c772157e4dd1ca74b341fa6f8c6ca

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8fd87a74ea9ed9ce7c20c2a2c89f9170e97c772157e4dd1ca74b341fa6f8c6ca
  
Dropping
MD5 1996b49a1a248983727546c565dcb08b

Comments