MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28e61a85878be9e78edae5bd26dfe416917ac8e48dddbbb1ca6487abdb67b319. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28e61a85878be9e78edae5bd26dfe416917ac8e48dddbbb1ca6487abdb67b319
SHA3-384 hash: e5f8809f93245481ebf30b9e7f30649e4b093922130597a85441e7ab19c62259f0cf07410e15f9ff6a1fea446a8042b4
SHA1 hash: 07b75987c0929e52407ad613cb5d94058c635dd1
MD5 hash: 97c231c2e3eb8978dffa331a13c54bc7
humanhash: georgia-april-nitrogen-mountain
File name:RFQ 00000000076.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'737'250 bytes
First seen:2020-08-05 09:12:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FDkGxQcpV8TAyxWXLI+LbeAiEe2wXqlnBryInEvfaeBQS:VBDp6TAy4LI4iXYRLE3BQS
TLSH F385F9169C3001D7269BF10B688AEA94151D72F048CBF6CA8FBDD5ED3F8189D60F8979
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Elango Balakrishnan <telango@iskanoman.com>
Reply-To: telango@iskanoman.com
Subject: RFQ-VENDOR 3 YEARS SUPPLY CONTRACT (RENEWAL OF LTPA 62431092)
Attachment: RFQ 00000000076.rar (contains "RFQ 00000000076.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28e61a85878be9e78edae5bd26dfe416917ac8e48dddbbb1ca6487abdb67b319/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:14:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/28e61a85878be9e78edae5bd26dfe416917ac8e48dddbbb1ca6487abdb67b319

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 28e61a85878be9e78edae5bd26dfe416917ac8e48dddbbb1ca6487abdb67b319

(this sample)

AgentTesla

Executable exe 872aaa3d5b005b0ad86226166438b998a20f3e1619b1bd2de4ab2f60398c809a

  
Dropping
MD5 52374b52d3256d48ff25668cbd411d0a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 872aaa3d5b005b0ad86226166438b998a20f3e1619b1bd2de4ab2f60398c809a

Comments