MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b57c1d411983db6ccfd47d6d077b2062ff180e06465c7063499a337d340e7486. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b57c1d411983db6ccfd47d6d077b2062ff180e06465c7063499a337d340e7486
SHA3-384 hash: fabd45c7be2abbbe3649aac3ed814c5d05d0c8bc2a30d5900e60e44520b57ec3e6a6a6bc6e25adbcec525fa868d21147
SHA1 hash: b38420125c1f9aaa2c77dfe36d99570218e3ba36
MD5 hash: e01074b32dc3f0e129744ef87d0825aa
humanhash: red-double-undress-golf
File name:Boleta de pago por transferencia bancaria USD_20,784.40.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:557'300 bytes
First seen:2020-08-04 07:10:06 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:L81YiOAKhRD+VOUwYxl2Pld3eqvDOpeaevKmAVjAYM:COAKX+VPwml2ddprXFYM
TLSH CDC4238FF6B510CADF66369CD2298594D4CF471F5A3A8E0C29CB53E56DB4588A003E2E
Reporter abuse_ch
Tags:AgentTesla ESP geo gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sl2.cyberfuel.com
Sending IP: 190.0.224.87
From: Gerencia <zonacentro@locsa.com.mx>
Subject: RE: Copia de impresión de confirmación de pago USD20,784.40
Attachment: Boleta de pago por transferencia bancaria USD_20,784.40.pdf.gz (contains "Boleta de pago por transferencia bancaria USD_20,784.40.pdf.exe")

AgentTesla SMTP exfil server:
mail.trademaxperu.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b57c1d411983db6ccfd47d6d077b2062ff180e06465c7063499a337d340e7486/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:11:05 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wv6b2qizqpnwzt6upvwqo6zaml7rqdqgizohay2jtizx2naoosda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b57c1d411983db6ccfd47d6d077b2062ff180e06465c7063499a337d340e7486

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b57c1d411983db6ccfd47d6d077b2062ff180e06465c7063499a337d340e7486

(this sample)

AgentTesla

Executable exe fc83deb95f3429cec6679ff8d3ebdcc3ef8cf4944bf0b83dd4d84e5f664b000b

  
Dropping
MD5 f7e4dc379ddd4b5270cb5ab2c3a87180
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc83deb95f3429cec6679ff8d3ebdcc3ef8cf4944bf0b83dd4d84e5f664b000b

Comments