MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16db1dd4ef4108c834c131c027aa2b6ca7def74b96daf776d61cfe517f6fa17d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16db1dd4ef4108c834c131c027aa2b6ca7def74b96daf776d61cfe517f6fa17d
SHA3-384 hash: 3f3a88f89d546000a453fe0918171b84e147881cc2be8257e244079a0bd4315527b464b302224846460ddd70d5b3cc48
SHA1 hash: 361f281af4b5173a2a6da94924660119043946bc
MD5 hash: 0f4454e000e0818a712dc5f6343e5405
humanhash: jig-solar-arizona-oven
File name:wire transfer.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'705 bytes
First seen:2020-08-04 16:46:50 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:y/h4FJb4v2GEYbJXJumG5bhm7r90INkMSFlDQFbdaZluXv+Z6kKt:idbJXLG5dmtzTSFlyQ7uXv+ZIt
TLSH 2094235A20D6887148FE21ECB837456E304015651AE039D30D3FEBE3EDD4D9A7AADB5C
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bex.net
Sending IP: 37.49.230.200
From: David Cooper <chihuahualvr@bex.net>
Subject: SWIFT payment
Attachment: wire transfer.Z (contains "wire transfer.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16db1dd4ef4108c834c131c027aa2b6ca7def74b96daf776d61cfe517f6fa17d/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 16:48:08 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c3nr3vhpieemqngbghacpkrlnst5552ls3npo5wwdt7fc73puf6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/16db1dd4ef4108c834c131c027aa2b6ca7def74b96daf776d61cfe517f6fa17d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 16db1dd4ef4108c834c131c027aa2b6ca7def74b96daf776d61cfe517f6fa17d

(this sample)

AgentTesla

Executable exe 76eb0a1ac3b7d29521384b9b1a600a6373c8c4ee93cdd2dac857f6add06c9800

  
Dropping
MD5 1d4d767e2078ff1631ad5e10507535e8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 76eb0a1ac3b7d29521384b9b1a600a6373c8c4ee93cdd2dac857f6add06c9800

Comments