MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05aa63793cd978f875ec172f713e13c9cae2b5657f36890d8191c65d51b5000c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05aa63793cd978f875ec172f713e13c9cae2b5657f36890d8191c65d51b5000c
SHA3-384 hash: 903019b1af151478f8c26801e98b4d01a7ad81bd19a76ff36b5e897dbb372f6f47b14d7f6c7378b5b97210630c297a2c
SHA1 hash: 8270438db9250979b922e38355ca62ee655f57f1
MD5 hash: 3cdcfcd5f2c5bae8a9507a74444afa5b
humanhash: spaghetti-don-double-india
File name:RFQ-Powertech Controls Co, Inc.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:937'314 bytes
First seen:2020-05-07 07:08:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GnuKn83Qlw9t0qXtltlBzFS2e6k9bhn+475E1nuKn83Qlw9t0qXtltlBzFS2e6k+:1jLXe6k99+yTjLXe6k99+yG
TLSH E61523FDDE7DE9936109087631BE3B19ADF93B2296F765B4E6607D204F9028200726CC
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: powertechcontrols.com
Sending IP: 89.40.181.101
From: David Ong - Powertech Controls Co Inc <davidong@powertechcontrols.com>
Reply-To: David Ong - Powertech Controls Co Inc <davidong.powertechcontrols@mail.com>
Subject: Fw: REQUEST FOR QUOTATION - Powertech Controls Co., Inc, Reference: 304147
Attachment: RFQ-Powertech Controls Co, Inc.rar (contains "RFQ-Powertech Controls Co, Inc.exe")

AgentTesla SMTP exfil server:
mail.alvadiwipa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 07:36:32 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=awvgg6j43f4pq5pmc4xxcpqtzhfofnlfp43isdmbshdf2unvaaga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 05aa63793cd978f875ec172f713e13c9cae2b5657f36890d8191c65d51b5000c

(this sample)

AgentTesla

Executable exe 5d100d55c4d2acf92f6f690e546c5a0e7ad6750520809a3f226783d99623aed7

  
Dropping
MD5 7bf4cb7edeedb6c539eb0beaf28371a7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d100d55c4d2acf92f6f690e546c5a0e7ad6750520809a3f226783d99623aed7

Comments