MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20ec67eef52eb793006001ba1b81efed2d8a1d32be4ebabac0d84362845e3ca5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20ec67eef52eb793006001ba1b81efed2d8a1d32be4ebabac0d84362845e3ca5
SHA3-384 hash: 9fb69637445384c53d421c2c1b75ddc3d55e5bbb5cd647632062d442880655c9226ff6795b33a5240ace51a289757af5
SHA1 hash: 265ab7327baa9e344bdcbc4355379d69d1fcaebc
MD5 hash: 10026f40bf9e81d2173d932c189c07d8
humanhash: robert-fifteen-leopard-lion
File name:SWIFT MESSAGE.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:502'962 bytes
First seen:2020-07-29 14:31:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UGor/gsuo9VKv5q2KesKAlj5axlTPIFDAPqNg4eRsd:UGorIf4VG5Z0KAaXUFDAP6ARC
TLSH 35B423A65140BE17BFA27CB24FC4608CE79527629338A374F98649582F83EC34D9F790
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: biz.globalfocus.co.ke
Sending IP: 93.104.213.39
From: angie <angie@ensignworld.com>
Reply-To: angie@ensignworld.com
Subject: Fwd: JUNE SOA PAYMENTS USD AMOUNT :21,369.05/= SWIFT MESSAGE attached - Remittance date 29TH JULY 2020
Attachment: SWIFT MESSAGE.rar (contains "SWIFT MESSAGE.exe")

AgentTesla SMTP exfil server:
mail.pkfpmes.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20ec67eef52eb793006001ba1b81efed2d8a1d32be4ebabac0d84362845e3ca5/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 14:33:05 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edwgp3xvf23zgadaag5bxapp5uwyuhjsxzhlvowa3bbwfbc6hssq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/20ec67eef52eb793006001ba1b81efed2d8a1d32be4ebabac0d84362845e3ca5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 20ec67eef52eb793006001ba1b81efed2d8a1d32be4ebabac0d84362845e3ca5

(this sample)

AgentTesla

Executable exe 38620b79b0821d5fc2a7e230a3e2c31f30773a749451c3618414d83f82e884e9

  
Dropping
MD5 c9c60dd8ba6718a2607ec3728cdd04b2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38620b79b0821d5fc2a7e230a3e2c31f30773a749451c3618414d83f82e884e9

Comments