MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a728bb818978f8782837b4042837b2782c57c75d5b05c236c566b29f3407876d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a728bb818978f8782837b4042837b2782c57c75d5b05c236c566b29f3407876d
SHA3-384 hash: 5ad89a8066cf16758359fcc8620afbc515d888a68a7f84c865c5958961fc42a8ec1ade75f87b9a1c18c9cff04aea6a29
SHA1 hash: 7f3f8e4b3ddde32ec3eb7aa2ccc431338ebcde1e
MD5 hash: 665bf7a75711201e97197b04fe5403f8
humanhash: shade-lion-football-grey
File name:Request for quotation PR 1100076872.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:565'311 bytes
First seen:2020-08-03 13:56:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:bVoB5NGv3/mCbUZTE7E7qfhSAB7MCSvpu:bVeyPFIZQ4iSANMrvpu
TLSH 71C4232211D46A23806337EDAC369E79EE03E3725E6BF4F051424B87EFD213329D9566
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blinux.thesecurededicatedserver.com
Sending IP: 198.52.104.94
From: PUNIT GIRISHBHAI KALARIYA-PROC-KURANGA <punit.kalariya@rsplgroup.com>
Reply-To: info@rsplgroup.com
Subject: Request for quotation | PR 1100076872
Attachment: Request for quotation PR 1100076872.rar (contains "Request for quotation PR 1100076872.exe")

AgentTesla SMTP exfil server:
smtp.blueskypaclficgroup.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a728bb818978f8782837b4042837b2782c57c75d5b05c236c566b29f3407876d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:58:19 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u4ulxamjpd4hqkbxwqccqn5spawfpr25lmc4enwfm2zj6nahq5wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a728bb818978f8782837b4042837b2782c57c75d5b05c236c566b29f3407876d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a728bb818978f8782837b4042837b2782c57c75d5b05c236c566b29f3407876d

(this sample)

AgentTesla

Executable exe 51f3a9f7ba793e867b3738a3f2707d11d3d839a099a70d6bb02c6b6aa68de4c8

  
Dropping
MD5 9d87b8e88fdf504fed31ee9f15b802c2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51f3a9f7ba793e867b3738a3f2707d11d3d839a099a70d6bb02c6b6aa68de4c8

Comments