MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 181a788c1cd36d88500ff4bc51e1d3f2aa89865efe1b13a133c18634e0574725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 181a788c1cd36d88500ff4bc51e1d3f2aa89865efe1b13a133c18634e0574725
SHA3-384 hash: d1f6747603bc2d2a43b572fbc28d0d937a7e584789f31892cf531977f618bee1be5db2f1cab74102ada730668c4f5098
SHA1 hash: bf91926ba77dc9b9f5c2a5203631bea6ec817ace
MD5 hash: 57e68e634d21bf14b2b20380328fcb5d
humanhash: tennis-massachusetts-paris-muppet
File name:SWIFT 001.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'666 bytes
First seen:2020-07-29 11:53:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:t8Xh7NnH99YwVRl8OiNVPMthoGQ+0VQMoe8LEfKWE7:aXNdH97Rl8zWGRVQleNKWE7
TLSH 4AA42398592095F3F8ABF2F8FD8874D6E87BA29E52F46151218F1B1C0D07823C5558FB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.qreyandcom.com
Sending IP: 45.95.169.97
From: Daisy Chiang (Ms.) <info@qreyandcom.com>
Subject: Fwd: Balance Payments MT103 swift Documents
Attachment: SWIFT 001.zip (contains "SWIFT 001.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.62857.7623.4157.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/181a788c1cd36d88500ff4bc51e1d3f2aa89865efe1b13a133c18634e0574725/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:55:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=danhrda42nwyquap6s6fdyot6kvitbs67ynrhijtygddjycxi4sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/181a788c1cd36d88500ff4bc51e1d3f2aa89865efe1b13a133c18634e0574725

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 181a788c1cd36d88500ff4bc51e1d3f2aa89865efe1b13a133c18634e0574725

(this sample)

AgentTesla

Executable exe c1ba82ca9dded6ae3ce6b4eb5efb1eb9f8887a40df95c6f3b818f54fd1e5ad53

  
Dropping
MD5 361adce20cce4855a8ef909eda8a1ba6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c1ba82ca9dded6ae3ce6b4eb5efb1eb9f8887a40df95c6f3b818f54fd1e5ad53

Comments