MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 002f8fe3fcdd75af1dc07ab7f179a2f6276d982a6d90e3519f33449817ae4b66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 002f8fe3fcdd75af1dc07ab7f179a2f6276d982a6d90e3519f33449817ae4b66
SHA3-384 hash: dac2a8e94de740716b006e3d6744d69f38eec763673d969c4d5ac94442a9a45004fd056faea8f10db795def064264d09
SHA1 hash: db4dd4cf92248c83f453851a094168ce6f832d78
MD5 hash: 764e0b2c8c74bcd3cdde06f23d4713cb
humanhash: red-social-quiet-two
File name:Swift Copy.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'850 bytes
First seen:2020-07-07 09:24:26 UTC
Last seen:2020-07-07 13:41:48 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:hsSnXW+lAFOCIW4pw30fg5g1nrM/O8BV1jTUG6:hsSnXW+CZ4y0Og1A/fBV+j
TLSH B594232DD28BAA046DB40CDBFD21B1E5C194F91F9188A6F3C52B4BEC6C9D1E64364237
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ayulintl.com
Sending IP: 185.222.58.152
From: Amirali Ladhani <admin@ayulintl.com>
Subject: Swift Copy
Attachment: Swift Copy.pdf.z (contains "Swift Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/002f8fe3fcdd75af1dc07ab7f179a2f6276d982a6d90e3519f33449817ae4b66/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:26:06 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aaxy7y743v226hoapk37c6nc6ytw3gbknwiogum7gncjqf5ojnta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 002f8fe3fcdd75af1dc07ab7f179a2f6276d982a6d90e3519f33449817ae4b66

(this sample)

AgentTesla

Executable exe 8ef0020970face69487e41b57753668ccf9c709843bd7ad776add915142906f4

  
Dropping
MD5 f7ab835d92dac1b11f66a5f5f457f8df
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ef0020970face69487e41b57753668ccf9c709843bd7ad776add915142906f4

Comments