MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fda96a178cca9b44ae215d4c4fc995a0a9886d1e3fc8f59cce4fbf7328264c69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fda96a178cca9b44ae215d4c4fc995a0a9886d1e3fc8f59cce4fbf7328264c69
SHA3-384 hash: dbe954f04b924915efc987bffe3b42f4e466a03b9286332a0b1b3f888fae7eb34baf3abddf49c1ddc8c79f5eb2c8bb00
SHA1 hash: 1bd1179c0d563211a231fe36d7358a8392c12002
MD5 hash: d24d0e055677beb3333cb90e682b2a35
humanhash: pizza-crazy-social-iowa
File name:Profoma Invoice_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:343'332 bytes
First seen:2020-05-01 11:13:47 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:ZckfHpA0pFjPEnn9YyML6XjLw8GTEswuw3AbCky7aUkSjYAjtXWWOizQMuChQSDK:RfHm0pFjsnn9YSXj0yswu/lQbkgtXW53
TLSH EB7423EC73370BA7E65716CDE8870A0F325366F639CA7D51EE7EA985C0D2B75A0A1010
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: paymontly.servers.prgn.misp.co.uk
Sending IP: 185.20.50.76
From: PO#INVOICE INQUIRY <contact@vvillowood.com>
Subject: RE: Billing Invoice: PO#12051992879
Attachment: Profoma Invoice_pdf.gz (contains "Profoma Invoice_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48219.7284.3681.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 11:36:21 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wuwuf4mzknujlrblvge7smvucuyq3i6h7eplhgoj67xgkbgjruq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz fda96a178cca9b44ae215d4c4fc995a0a9886d1e3fc8f59cce4fbf7328264c69

(this sample)

AgentTesla

Executable exe 5d3c65ee71f5ed252540489c16fa247131265123b6315730c4ab00810c5cedae

  
Dropping
MD5 eb2bd9094e18edffc9c09da507dd48a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d3c65ee71f5ed252540489c16fa247131265123b6315730c4ab00810c5cedae

Comments