MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc5c71b8acb2dce229a924825d35e7cf8356d224c6105a511375c043905fd1a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc5c71b8acb2dce229a924825d35e7cf8356d224c6105a511375c043905fd1a3
SHA3-384 hash: 5250e3f9352ac114ec7ff1ca357559a9511e5474fb2374685fd742ae72d739abe45527cf78489d36bfe2be9331f573e0
SHA1 hash: 11becb12ad9913fe9e6d6144281b7c3eb60de71b
MD5 hash: a948a8e0e8ff3904ebe4c5ad240f70bb
humanhash: jersey-iowa-zebra-hamper
File name:Remittance_Advice_ 4425.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:583'900 bytes
First seen:2020-06-01 20:01:07 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:3nlWOb3WR5e4+O7wxY7Phj2QZZbRLsVKfNfcWz3WwHYzo60qBS/aB4OLHub/YEdq:3lrb3y/cx+ZzsEhqoqBFBB2YE1Jt0/T
TLSH 77C423353D240F7021FB00D54E5CC6EFC2CB455A1225560AA21AE7C6AB377E9FA72DB2
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eggs.gnu.org
Sending IP: 209.51.188.92
From: Accounts Payable <nienow@andreloganjr.us>
Subject: Remittance Advice for Overdue invoice 6/1/2020
Attachment: Remittance_Advice_ 4425.gz (contains "Remittance_Advice_ #4425.exe")

AgentTesla SMTP exfil server:
mail.almushrefcoop.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 20:36:25 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rohdofmwlooeknjesbf2nphz6bvnureyyifuuitoxaehec72grq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz dc5c71b8acb2dce229a924825d35e7cf8356d224c6105a511375c043905fd1a3

(this sample)

AgentTesla

Executable exe ecc29b757523ab53734576e3e3138b939a2813d2a6a0a50ef060638025ac5b0e

  
Dropping
MD5 66492da13eb3db5c7db789847e415ac1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ecc29b757523ab53734576e3e3138b939a2813d2a6a0a50ef060638025ac5b0e

Comments