MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 795fd720d4bc05edcd0c56c4421527846c057ed35ae79d0fb3afb5d3e1d3f0ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 795fd720d4bc05edcd0c56c4421527846c057ed35ae79d0fb3afb5d3e1d3f0ef
SHA3-384 hash: 833b758fe8f26c33dcf17378ee34be64bd77d1aa61139766ff53699f7a1d7885f09f63d9f639105c37fcb0c671018579
SHA1 hash: ed0797e9d291cc1619e3d6f31820e15c198a9093
MD5 hash: dd1d52b8f484ccc25b35b1c33032c9a5
humanhash: fruit-oregon-venus-grey
File name:proforma invoice.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:639'770 bytes
First seen:2022-10-21 07:37:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:IquAlGy3VXr8mW8LyhTNicglgOzvJi/dFVYISYlqS0gX2+IAn+tk2RCRcpUcCGW:DFh39TLyLicglCpdSYwS5EAKRCYU+W
TLSH T1BBD423E9870D85E4D5DF22E15F1288D9C4B33F2B158285D82712191B7E8E7FE79EEA00
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla payment z


Avatar
cocaman
Malicious email (T1566.001)
From: "Susan Wang <ade.why@kleenkit.com>" (likely spoofed)
Received: "from getbjlqd.kleenkit.com (getbjlqd.kleenkit.com [85.217.145.11]) "
Date: "Fri, 21 Oct 2022 04:38:07 +0100"
Subject: "Confirm Correct Bank Details For Balance Payment"
Attachment: "proforma invoice.pdf.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:version.txt
File size:1'624 bytes
SHA256 hash: c49bace26979053832ca0ed3ea857de31b08247a2f327630a98d01d1e35510f4
MD5 hash: f191d09d5e095fbb4eba4b9a9fb6dbdf
MIME type:application/octet-stream
Signature AgentTesla
File name:1
File size:490 bytes
SHA256 hash: 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a
MD5 hash: b7db84991f23a680df8e95af8946f9c9
MIME type:text/xml
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/63524c5ba67b0a5ed57a8d3c/reports/0c55ed96-d7de-442f-ad43-00385dfdfa1c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/795fd720d4bc05edcd0c56c4421527846c057ed35ae79d0fb3afb5d3e1d3f0ef/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-21 03:42:55 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 41 (51.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfp5oiguxqc63timk3ceefjhqrwak7wtlltz2d5tv625hyot6dxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/795fd720d4bc05edcd0c56c4421527846c057ed35ae79d0fb3afb5d3e1d3f0ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 795fd720d4bc05edcd0c56c4421527846c057ed35ae79d0fb3afb5d3e1d3f0ef

(this sample)

AgentTesla

Executable exe d45e5775d0d833995cf846f564dc8185ffaa53706a8c27cca07c941b1aaa42fd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d45e5775d0d833995cf846f564dc8185ffaa53706a8c27cca07c941b1aaa42fd
  
Dropping
MD5 e9818337544c22a50868e160f250d087

Comments