MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d0d1feca85cfb51bbd3f955e6e40782d7e0c7a84ab9f0888360d66d6d8821d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d0d1feca85cfb51bbd3f955e6e40782d7e0c7a84ab9f0888360d66d6d8821d9
SHA3-384 hash: 95f4386027742a314955076fcb57e0424214569ce2ea12af26d5af65bdcf9b82d1d11e581e7293ea580070db34bf3789
SHA1 hash: e7ec88a6af25051745c52ab5f26632aa1c500c91
MD5 hash: 92bb38051c7e3c99533e9846e6744d31
humanhash: yellow-fifteen-stairway-finch
File name:Purchase Order No-200520- S.B.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'911 bytes
First seen:2020-06-24 05:10:52 UTC
Last seen:2020-06-24 10:47:29 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:IrFB5DH2Jf5nenuUGSzEqeKLV1W+9tZ90QbB:cS/npUHIqeKK+9tz0QV
TLSH B19423E9382CC5A64EE3B1537AC65C33A5D3B1AD2D2FF3A45A16830E4665708FE5813C
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Mary <sahara@emirates.net.ae>
Received: from emirates.net.ae (unknown [167.88.9.89])
Date: 23 Jun 2020 21:06:19 -0700
Subject: Resending Purchase Order
Attachment: Purchase Order No-200520- S.B.pdf.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d0d1feca85cfb51bbd3f955e6e40782d7e0c7a84ab9f0888360d66d6d8821d9/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 03:42:23 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lugr73filt5vdo6t7fk6nzahqll6br5ijk47bcedmdlg23miehmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5d0d1feca85cfb51bbd3f955e6e40782d7e0c7a84ab9f0888360d66d6d8821d9

(this sample)

AgentTesla

Executable exe ce223e483267a92e2b040c5a611c08f0f50751975b4bb382068f3068c426057d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ce223e483267a92e2b040c5a611c08f0f50751975b4bb382068f3068c426057d
  
Dropping
AgentTesla

Comments