MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02d6dbb3165de9592e977ba76889f02e55e16d736523cda39f1d0bc9a4183061. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02d6dbb3165de9592e977ba76889f02e55e16d736523cda39f1d0bc9a4183061
SHA3-384 hash: e89e7580b0d5f8922db4984b51bef33c3d13bb129c5feaf92858b9a9921b4773920eb6fdf40210e72c50c3081d33d788
SHA1 hash: b96dfb7fcef8158f2c79d77547c2d1a026088c73
MD5 hash: f525816d4b3f50ca9e8bc833dace5667
humanhash: five-harry-mango-pasta
File name:SWIFT COPY.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'891 bytes
First seen:2020-05-11 14:44:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:uhZdEVdL0UfVRbdIocVED5Q33W2/PBJ+9SjOAoXEBEgwCUuYsPeJQcX8zcABQndu:uGVBdbM3rHBos7oqwC6sva8tq9WKu
TLSH 479423ECD12C697DB3140156C976AE011D2C3B04BE47E1BEE8165EA760FA853CF31AAD
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mediaminds.biz
Sending IP: 103.145.254.227
From: Ahmed Akram<ahmed.akram@mediaminds.biz>
Subject: Fwd: Wire payment
Attachment: SWIFT COPY.rar (contains "PNLRNIK8KjWuyYD.exe")

AgentTesla SMTP exfil server:
webmail.pat.ps:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 15:36:54 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=allnxmywlxuvsluxpotwrcpqfzk6c3ltmur43i47duf4tjaygbqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 02d6dbb3165de9592e977ba76889f02e55e16d736523cda39f1d0bc9a4183061

(this sample)

AgentTesla

Executable exe 967cd8bbe45bf8ccc045f202904c7252d9da36132b0b4dc164b2208555b8b167

  
Dropping
MD5 a4bef1e4d72ed12dbe76fc76d8d1ccb4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 967cd8bbe45bf8ccc045f202904c7252d9da36132b0b4dc164b2208555b8b167

Comments