MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fc495546a033d15a7d7a70804e1c6cec46d9de68d9e36a07fda9b6d4840b5a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fc495546a033d15a7d7a70804e1c6cec46d9de68d9e36a07fda9b6d4840b5a7
SHA3-384 hash: c3b57c020b34d7fa97fc7d15042e2172651a573e7c87290ab19349fdf48254f072e68ae736e54965d023ad581f29274b
SHA1 hash: 8e7193019ef136e4f1c204f83203790f77169669
MD5 hash: 901b1b8c938b4a03ae8187088ba6eb10
humanhash: bulldog-delta-grey-floor
File name:Motilaloswal Outstand Reminder.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'693 bytes
First seen:2021-03-09 15:55:09 UTC
Last seen:2021-03-11 06:18:47 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:PhZxohhZMCNmLUU3w2P+A1ysm8dioDA6ITZAY6BVLzcxyVvs+bhTuip1F4et:P/uhhZJNmL13w2P+eysm8YCITGY6VExc
TLSH 2384237E6B0424683BFEFDCF52536442427CEC22D4C1479E9B7B42241F14CA2A6EE59E
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: host.purvainfosystems.in
Sending IP: 69.16.249.73
From: Shallet Caldeira <Shallet.caldeira@motilaloswal.com>
Subject: Outstanding Reminder.
Attachment: Motilaloswal Outstand Reminder.gz (contains "Motilaloswal Outstand Reminder.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DLB.genEldorado.20613.29042.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 09:54:54 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l7cjkvdkam6rlj6xu4eajyogz3cg3hpgrwpdnid73knw2scawwtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5fc495546a033d15a7d7a70804e1c6cec46d9de68d9e36a07fda9b6d4840b5a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5fc495546a033d15a7d7a70804e1c6cec46d9de68d9e36a07fda9b6d4840b5a7

(this sample)

AgentTesla

Executable exe dc3c0dc5884f2252d2632da5c719e49080197ae9e06dd7438a31c65b800d3f84

  
Dropping
MD5 3c6717c101dfc91c08bd4550c746f7a6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc3c0dc5884f2252d2632da5c719e49080197ae9e06dd7438a31c65b800d3f84

Comments