MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5fead202206ef711c0db3bed1b5aec8f86d9cc3f367cb20e5959e5c99f641fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5fead202206ef711c0db3bed1b5aec8f86d9cc3f367cb20e5959e5c99f641fe
SHA3-384 hash: 3490bec3111f0f60cc2555f506ece74a8d8c43bfb857e3fd6c4c909c63ef3335c1c60dba91209fdf11926b342d60227f
SHA1 hash: 16a303c862965754374c17291d94f721c59e6f95
MD5 hash: 6e12bcd79a02a715233378ac4610cfde
humanhash: juliet-california-quebec-illinois
File name:Purchase order No.PO8100000966 .pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'495 bytes
First seen:2020-06-15 12:00:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:ZNK13eT8Q/1JSrmE7OLgf1sBF32jzaUTaw5XI/zJDeghSdb0hEaM+Vuy7HZGFWEF:ZNyuTdTw+F32xTaw1Iz1lzEaMa7HkF3F
TLSH 218423A7392C72C7C9C4B50CC6E781B06EE4FB421587A65E82FBB31093492ED5B0176C
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: w2k12mx04.dc1.ca.ihglobaldns.com
Sending IP: 192.175.105.170
From: Polygon Adhesives Head Office <f.zandi@parskavir.com>
Reply-To: f.zandi@parskavir.com
Subject: New Purchase order No.PO/8100000966 - CSA-7839 Dt.15.06.2020
Attachment: Purchase order No.PO8100000966 .pdf.gz (contains "Purchase order No.PO8100000966 .exe")

AgentTesla FTP exfil server:
ftp.dorsea.my:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:02:07 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ux7k2ibca3xxchanwo7ndnnozd4g3hgd6nt4wihfswpfzgpwih7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a5fead202206ef711c0db3bed1b5aec8f86d9cc3f367cb20e5959e5c99f641fe

(this sample)

AgentTesla

Executable exe a388721677699e1816b5a7812b0c7bfa301cbe1539aae18fad07c98f85e16168

  
Dropping
MD5 bf4704a53812fc486e7e41d9a61fdf1a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a388721677699e1816b5a7812b0c7bfa301cbe1539aae18fad07c98f85e16168

Comments