MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5a6653b0c32223554dc2db0b14885aa809121558038a61116ebdd9d52a9a23c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5a6653b0c32223554dc2db0b14885aa809121558038a61116ebdd9d52a9a23c
SHA3-384 hash: 0410e9dced1654e11f77538139fd3b354bf0661d6487abe2e0ecf330c8bb2a98710163cfde9107a0306743e339f10579
SHA1 hash: 1990763119161b6997e5293df5ce6f8cb433633c
MD5 hash: 82a7c6677d56a12822f9d0e8af3acc8a
humanhash: lactose-seventeen-jig-table
File name:TT copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:469'077 bytes
First seen:2020-05-08 08:23:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:U4tZQ5yy92hcynMo8NEYH3r4Hg1rwu+PJ+Y9RTCDjXRdoe1sLyP8J579tkh2lldv:UYZQ5yy4h9F8NJHdi99hKae1q48f7rv
TLSH B1A423F63F203E861AC153BD2615DAFEB457412B5B56BA06C6219FF1890EC7AD381CC2
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: firstbank.ro
Sending IP: 103.145.254.227
From: ANCA GABRIELA BORS>anca.bors@firstbank.ro
Subject: Re: TT copy
Attachment: TT copy.rar (contains "TT copy.exe")

AgentTesla SMTP exfil server:
theroyalsandskohrong.com:587

AgentTesla SMTP exfil email address:
marine@theroyalsandskohrong.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 03:26:18 UTC
AV detection:
17 of 30 (56.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwtgkoymgirdkvg4fwylcsefvkajcikvqa4kmeiw5poz2uvjui6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a5a6653b0c32223554dc2db0b14885aa809121558038a61116ebdd9d52a9a23c

(this sample)

AgentTesla

Executable exe 626869fcb3d6bf9d7106bdecca76202548fa0dab84fcffda41b9bbcd6c6f5da2

  
Dropping
MD5 27b1eeae08bf0edc69043e4b86aa302b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 626869fcb3d6bf9d7106bdecca76202548fa0dab84fcffda41b9bbcd6c6f5da2

Comments