MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36973a03e29c181755be37b93ace8aa6307158ea4ea85577704b141390238766. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36973a03e29c181755be37b93ace8aa6307158ea4ea85577704b141390238766
SHA3-384 hash: ce58a2d3d10d77ac7e746c6b672d2405f5552e9c4fb3efe8185a50d944c82a82e7e7c8052b808cbeceb310f2cd6a7a66
SHA1 hash: 60182a30b2e6800e136ff8a79ad8241f4e3e8e64
MD5 hash: 91788f55c7aaa67f138e032b69a1905b
humanhash: utah-rugby-earth-jupiter
File name:Atl RFQ .Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:563'129 bytes
First seen:2020-08-19 07:19:50 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:6/Tdinbdqup0HFoGMN5KPHaV7UqqIbIj5Edj4tt+1X:+EnUu202P6dkInN1X
TLSH 16C423C29A594FECE059DBC993067C2C847358A7C47298F667F8CC1327B4EA329DD528
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zero06.nayana.kr
Sending IP: 218.145.71.174
From: Victor Russell <manoj@msvfabrics.in>
Subject: Request for quotation for Atlantic UK please treat this as urgent
Attachment: Atl RFQ .Gz (contains "wikfyfxYNvAzYhV.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36973a03e29c181755be37b93ace8aa6307158ea4ea85577704b141390238766/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 07:21:07 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g2ltua7ctqmbovn6g64tvtukuyyhcwhkj2ufk53qjmkbhebdq5ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/36973a03e29c181755be37b93ace8aa6307158ea4ea85577704b141390238766

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 36973a03e29c181755be37b93ace8aa6307158ea4ea85577704b141390238766

(this sample)

AgentTesla

Executable exe 70e55061f4e965a512c042bc1541f3d4e5a910a493ffb63d5a123f9c82a94f70

  
Dropping
MD5 1e048dcc78f6887525eeec0e1c2b6023
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70e55061f4e965a512c042bc1541f3d4e5a910a493ffb63d5a123f9c82a94f70

Comments