MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43f06e8665afbd1a8ad5b69a0e37973705b6e21863e082642bb57ebd0eb404f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43f06e8665afbd1a8ad5b69a0e37973705b6e21863e082642bb57ebd0eb404f2
SHA3-384 hash: 498a950d5b5be16e73d5b3616bc2fcdb17b276c4397927e143e83b56c474cafb30315ea9c46089d610b9cc3ac937247e
SHA1 hash: c02e62512bcf6ad02ca076f8a466cb4c9feb9556
MD5 hash: aa433a051f22cf87bb3c2475da5d287f
humanhash: early-vegan-connecticut-bakerloo
File name:Payment Ref MT 103 459B02AD001.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:524'242 bytes
First seen:2020-07-09 12:20:03 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:aFo09GyM4GubamVAutduaAMfSdAAN7PfqsQJpt/nOq:QfjLVldZTf5ETqsQpB
TLSH 79B42321CBDBD6ABDEEC639F11FD25406759A5A6C4C3A808D8F1F09BD23815EB05C239
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: luplastic.com.br
Sending IP: 45.143.222.106
From: Laura Wang <vendas@luplastic.com.br>
Subject: RE: payment reminder!!
Attachment: Payment Ref MT 103 459B02AD001.r00 (contains "Payment Ref MT 103 #45980238001.exe")

AgentTesla SMTP exfil server:
smtp.chaikistomato.us:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43f06e8665afbd1a8ad5b69a0e37973705b6e21863e082642bb57ebd0eb404f2/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 12:21:10 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ipyg5btfv66rvcwvw2na4n4xg4c3nyqympqiezblwv7l2dvuatza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 43f06e8665afbd1a8ad5b69a0e37973705b6e21863e082642bb57ebd0eb404f2

(this sample)

AgentTesla

Executable exe 9169d246ccab4d7206fd3a6d294c628d1e9b8ed33329cc025170f546a7c5671e

  
Dropping
MD5 4a529abd1165507b2d18064fa1f1769e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9169d246ccab4d7206fd3a6d294c628d1e9b8ed33329cc025170f546a7c5671e

Comments