MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a66f7ea6a759b10b767eb68b1e4490bcd183a17e846387f4cd681785951d971c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a66f7ea6a759b10b767eb68b1e4490bcd183a17e846387f4cd681785951d971c
SHA3-384 hash: 4cd6853268e354d3312ed98fc1b730710c8581f6b3d80fa00f12aa42a91fcbb4b73bc03a47e1f22b71b00f0ef646f412
SHA1 hash: 96fc4e8c98f4e027eed5ec23067cb678e3cda896
MD5 hash: 574f6f263522fe2217f12019faac70fd
humanhash: golf-fifteen-bluebird-don
File name:TT COPY.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:995'343 bytes
First seen:2020-06-02 10:31:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:48Tup2cPBc+0JHD7nxfj/HuFUPe1mHxuUZ0f060ox:dTu5Bc+0JH/RHxUmRJ0f0a
TLSH EC25336D9076AFEAAE813732F215FB28CECB513441E64739F0CC5B8E4C49265D26F14A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fmgloballogistics.com
Sending IP: 103.99.1.173
From: Saylu FM Global Logistics (M) Sdn Bhd<saylu.ng@fmgloballogistics.com>
Subject: FW: RE: payment request
Attachment: TT COPY.rar (contains "TT COPY.exe")

AgentTesla SMTP exfil server:
mail.microtechlab.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 10:37:14 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uzxx5jvhlgyqw5t6w2fr4reqxtiyhil6qrryp5gnnalylfi5s4oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a66f7ea6a759b10b767eb68b1e4490bcd183a17e846387f4cd681785951d971c

(this sample)

AgentTesla

Executable exe f99ca3b27556f13c8fb5f1fb6ac5f6149eb3f0e7c9023ad59ec95a14f81e6c7b

  
Dropping
MD5 52ea78f698dd8624cc6cf3ccf92980dc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f99ca3b27556f13c8fb5f1fb6ac5f6149eb3f0e7c9023ad59ec95a14f81e6c7b

Comments