MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dc91a2c82b74653ace071212f2d5a09aa259c462a10f8bd0f630ffd891ac98f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5dc91a2c82b74653ace071212f2d5a09aa259c462a10f8bd0f630ffd891ac98f
SHA3-384 hash: dc2b1dc1b7ac9756bafead44cd3d0557776e9a0e20c958fe7a6cea2ff3223c169e65caa3e8adc46e197195eb870d4983
SHA1 hash: fea59030013e8222bde5ed1eb5d334625703abcc
MD5 hash: 5b90cdc6bd3fe446896456e1234c47fa
humanhash: mango-fourteen-colorado-football
File name:INVOICEfatura onay.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:662'320 bytes
First seen:2020-08-28 06:45:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:bJHQa9dn/cx0kEK8ukrzc2pRfGNPxINIAihBLoYDpo7KKTI04:br91/cREVukHcgRuNpIN+BMYDuGKTIR
TLSH C6E42363DD715C36F208A384E4B6CDC8AD0FB3D8D52563BC1A6E5CD6AB4B0E5A90F409
Reporter abuse_ch
Tags:AgentTesla Akbank geo rar TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lhost2.websahibi.com
Sending IP: 213.142.130.121
From: Akbank Dış Ticaret <servis@disticaret.akbank.com>
Reply-To: servis@disticaret.akbank.com
Subject: Ödeme makbuzu#Payment
Attachment: INVOICEfatura onay.rar (contains "INVOICE#fatura onay.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5dc91a2c82b74653ace071212f2d5a09aa259c462a10f8bd0f630ffd891ac98f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 05:35:27 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxerulecw5dfhlhaoeqs6lk2bgvclhcgfiiprpipmmh73ci2zghq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5dc91a2c82b74653ace071212f2d5a09aa259c462a10f8bd0f630ffd891ac98f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5dc91a2c82b74653ace071212f2d5a09aa259c462a10f8bd0f630ffd891ac98f

(this sample)

AgentTesla

Executable exe c412834eac0908dbc79b537c7c00dfafae1c70df16d3b095b631067250eca2fc

  
Dropping
MD5 53a3202312bd58e256294e839b1518b8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c412834eac0908dbc79b537c7c00dfafae1c70df16d3b095b631067250eca2fc

Comments