MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43aafd8cd6cc9c52365f7cb04e5b670074b02b06cc5514cb8de21f96d2a6b6a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43aafd8cd6cc9c52365f7cb04e5b670074b02b06cc5514cb8de21f96d2a6b6a4
SHA3-384 hash: d2055ebe1e969e797d9cd83669a6b7287a7ecc83c672f0b024c505f4943816c3e695a9c49c3ac6a0b2387c3490d8ea8d
SHA1 hash: fe20b6fc4a8bb60101ef3ae2b317bcea06994f53
MD5 hash: 6170bc8b816968928b423c7bd084b2fa
humanhash: four-sweet-pip-magnesium
File name:Listed Purchase.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:475'647 bytes
First seen:2020-08-12 15:20:08 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:msSW99thjOHAbnNxeC/ZgAORsdA8rZAC/0FqfTY:L//KgbnNzXOmdA0GYnY
TLSH FCA4239990DFCA6F068B8AF0E05046A2171BFB5F7E4DE4F188744A70BE896E4541CDE3
Reporter abuse_ch
Tags:AgentTesla uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1uk.supremebox.com
Sending IP: 46.249.205.81
From: Hassan Ahmed <thansi.ap@shaklangroup.com>
Subject: Fwd: URGENT ORDER
Attachment: Listed Purchase.uue (contains "okurtrte.exe")

AgentTesla SMTP exfil server:
smtp.mail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43aafd8cd6cc9c52365f7cb04e5b670074b02b06cc5514cb8de21f96d2a6b6a4/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:22:06 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iovp3dgwzsofens7psye4w3hab2lakygzrkrjs4n4ipznuvgw2sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/43aafd8cd6cc9c52365f7cb04e5b670074b02b06cc5514cb8de21f96d2a6b6a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 43aafd8cd6cc9c52365f7cb04e5b670074b02b06cc5514cb8de21f96d2a6b6a4

(this sample)

AgentTesla

Executable exe c953db5455cedad0e98747749e5a6df0d5d10362831bb472ea5c023868642f01

  
Dropping
MD5 018cc52d795983386fb5b4409da56c28
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c953db5455cedad0e98747749e5a6df0d5d10362831bb472ea5c023868642f01

Comments