MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae73505a1030cb339896ffa52f5f7bbac392513b8464e56123db410af115a709. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae73505a1030cb339896ffa52f5f7bbac392513b8464e56123db410af115a709
SHA3-384 hash: 5a0c698abc9b16cddb830bfc5db4be2018a5a22ea5c4150cc2195bd60b3c4ca26ea37dad471cfeed4d7714c06da66f96
SHA1 hash: 3f4fdd5f44cfded05c95bbad48e5245cb4c388cc
MD5 hash: b66e984f04c0e60f746cf7a5b6770012
humanhash: avocado-uncle-hotel-wolfram
File name:SWIFT COPY.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'857 bytes
First seen:2020-05-19 14:15:20 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:hwINH5LGJAgH9K5yqI/thGeSfeFrnpYHEjVJYNtfFK:SIx5SVkb+ueNppVJ2tNK
TLSH 4B9423FF411782ACA4B17A0800F7777DF8E4756AD89746B50A96C0F8BF86D818E4946C
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv1.demspor.com
Sending IP: 31.169.94.221
From: Maria Rosa Donzelli <finike@collu.com.tr>
Reply-To: Sale<pazarlama@eymer.com.tr>
Subject: RE:PAYMENT
Attachment: SWIFT COPY.r00 (contains "kikiki.exe")

AgentTesla SMTP exfil server:
mail.mkkarakosemobilya.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 14:26:11 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vzzvawqqgdfthgew76ss6x33xlbzeuj3qrsokyjd3naqv4ivu4eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 ae73505a1030cb339896ffa52f5f7bbac392513b8464e56123db410af115a709

(this sample)

AgentTesla

Executable exe f8308e10cb652b941d811d09b3293e3f73f73f715e53d61cbcbe2d7d28387d6e

  
Dropping
MD5 6cd11fe1038867baa38ad7fbce1298b6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8308e10cb652b941d811d09b3293e3f73f73f715e53d61cbcbe2d7d28387d6e

Comments