MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a3652c9d19862d41a9aa461544ca78f2a3ea9c3ea00f9dd4ad92da4d2d42f14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a3652c9d19862d41a9aa461544ca78f2a3ea9c3ea00f9dd4ad92da4d2d42f14
SHA3-384 hash: c5cafe73cb62faa87b451a2d6ac45e43a425612212f9e573af8327d5ec1e15abd127ec0096c0e38bad38ad9a1f871720
SHA1 hash: 3ad58425ee0b1744117b3c6422be13bc70a2a0dc
MD5 hash: 07d5e20e3187510923a41dae53cbd993
humanhash: arizona-lake-pizza-coffee
File name:Quotation_AxFlow_0943565624453003.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'823 bytes
First seen:2020-05-26 08:14:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:S2J386aSXu4mY5dHF7yOu+glJ/6p78Zsd4io8x2jmSg4nbxC:S43h1lmgFhu+eip8Zsdx2jmSPFC
TLSH C48423EC48AF33A0E4892B7F92F622F437DC6C6C2792EC013BE289D71699FC55195605
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dasos-ones.pw
Sending IP: 206.125.44.194
From: Biscotti Tsoungari <custserv@fluoroseal.com>
Reply-To: mcclain@furaffinity.com
Subject: REQUEST PO-012580 (New Vendor Requirements)
Attachment: Quotation_AxFlow_0943565624453003.rar (contains "Quotation_AxFlow_0943565624453003.exe")

AgentTesla SMTP exfil server:
mail.novadelmar.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:42:10 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
16 of 30 (53.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5a3652c9d19862d41a9aa461544ca78f2a3ea9c3ea00f9dd4ad92da4d2d42f14

(this sample)

AgentTesla

Executable exe bc3401d05a180606f7593e377e8bb1070c06c90cde1e268954f43e44d8b571a6

  
Dropping
MD5 6bdc3dc75ab89568188371c346b93c71
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc3401d05a180606f7593e377e8bb1070c06c90cde1e268954f43e44d8b571a6

Comments