MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ded5d1e8d72f9cb5365460eb62ebb40799a2e48d2c7ac14e7cb6ad3214dfbcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ded5d1e8d72f9cb5365460eb62ebb40799a2e48d2c7ac14e7cb6ad3214dfbcf
SHA3-384 hash: 82129c99fc9e62578f94c22f6863ed8f9896ac81737e0b1416843166d41ba7ab75e323f0914182b8ff6dbb501b90195e
SHA1 hash: 7439ae010da5c8ed97bf1ee2ed0947e0d86dbfa0
MD5 hash: b7cf3530e3c9122520fcaba9d800fdd5
humanhash: emma-butter-cola-sodium
File name:PURCHASE ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'398 bytes
First seen:2020-05-06 10:46:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:uw1lFEFPBRzohLUybp5kUqFQG4hTXe4OK+jpUzblRSpvcg13AsEtzZ+gbCTDe6fF:uszUUhAytiUq/2KjKdnapujtsHxJr
TLSH 81942388F8B4C7418CB8E8D6E3A14F9158250A8C1E4383F7FE94F39B99E7D326594B54
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: khusheim.com
Sending IP: 103.99.1.173
From: Mubeen Ur Rehman.K.K<proc29@khusheim.com>
Subject: RE: QUOTATION 
Attachment: PURCHASE ORDER.rar (contains "PURCHASE ORDER.exe")

AgentTesla SMTP exfil server:
mail.villalefkothea.gr:587

AgentTesla SMTP exfil email address:
info@villalefkothea.gr

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 11:35:51 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxwv2hunol44wu3fiyhlmlv3ib4zulsi2ld2yfhhznvngikn7phq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5ded5d1e8d72f9cb5365460eb62ebb40799a2e48d2c7ac14e7cb6ad3214dfbcf

(this sample)

AgentTesla

Executable exe a3b4f9b425bfb0ac4ea5c7007f880658910320c95312766d59ffa6d44a658926

  
Dropping
MD5 5a81cb093f69236676b9a94bcbab8ffa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3b4f9b425bfb0ac4ea5c7007f880658910320c95312766d59ffa6d44a658926

Comments