MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 056360d822a24799e1d06f3dc7843fda702346753fe7c8b3f6f3691f9931cf8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 056360d822a24799e1d06f3dc7843fda702346753fe7c8b3f6f3691f9931cf8c
SHA3-384 hash: 1bf174e8efe7888dacc9fface6e9cbbee2a49983ffad8abd6bf2e7562086769ca84da8235aaae8ecae8cb8e6414b6083
SHA1 hash: b954c9ae4a61c619986fc7a396015d53a88980ea
MD5 hash: 1677b6a476d7340af52009dacb4d6fb8
humanhash: magnesium-sierra-seventeen-neptune
File name:Swift Copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:932'512 bytes
First seen:2020-06-18 06:05:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FRZ+LNu0Ic6N4mIPbyh8037HVdqc9/j5MKFSW5dL6:FReLbPbG37HzZ9/j5MhW5du
TLSH 4F15239C7FA66A69E96E70F2D135704DA015611A1A3F0F00646D9FEC03B6CB2C5FC6AC
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.161
From: William Ko <opr6.ae@absaco.com>
Subject: June Payment
Attachment: Swift Copy.rar (contains "Swift Copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:07:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=avrwbwbcujdztyoqn464pbb73jycgrtvh7t4rm7w6nur7gjrz6ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 056360d822a24799e1d06f3dc7843fda702346753fe7c8b3f6f3691f9931cf8c

(this sample)

AgentTesla

Executable exe 745110c4c62b046770c913cb9c5760e4728047f6ccf08fcdac12f8c3f9ac0be1

  
Dropping
MD5 113dd222f32f0296e2666da5a76e90f5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 745110c4c62b046770c913cb9c5760e4728047f6ccf08fcdac12f8c3f9ac0be1

Comments