MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 252646ee2dc83b043480ccbf81f1c5d9126879c81feec5b70d7b31a8d54bc6a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 252646ee2dc83b043480ccbf81f1c5d9126879c81feec5b70d7b31a8d54bc6a5
SHA3-384 hash: 169ddd0179c45888d8c53134b0088dded6d439de516c8b3ef5b42bce2215c66dc4caa5959128c61b3c88d65ad18ededf
SHA1 hash: 4ee70ede06ddf1c76dde2c6ca99ea110b337368c
MD5 hash: 1b65d53c9705d4135b29ae3efb6b2c0d
humanhash: kilo-papa-fix-batman
File name:SwiftTRB032896541286452790001545665400111.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:898'010 bytes
First seen:2020-06-10 07:23:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Y15h7bxWNFyGpNMkZG+F0Z6TdEI5BPHRZgbnD:YzhPxWH5NFjhhEwPHDg
TLSH 931533E18B2350D4EE749E40BE0CA82F407D7A3903604D15FB58A9264C76E93F39B76E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns12.iraq-dns.com
Sending IP: 185.52.101.73
From: Jaslin Hong <Jaslin@itxtrading.com>
Subject: New Purchase Order
Attachment: Swift TRB032896541286452790001545665400111.rar (contains "Swift TRB#032896541286452790001545665400111.exe")

AgentTesla FTP exfil server:
ftp.irregnancised.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:25:08 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=euten3rnza5qineazs7yd4of3ejgq6oid7xmlnynpmy2rvkly2sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 252646ee2dc83b043480ccbf81f1c5d9126879c81feec5b70d7b31a8d54bc6a5

(this sample)

AgentTesla

Executable exe fa309daad5243e93967f396f770466383bd74dd20a0b83c1593d55a6e66e973e

  
Dropping
MD5 d5d3133af717915b73ad7e5fa70ad522
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa309daad5243e93967f396f770466383bd74dd20a0b83c1593d55a6e66e973e

Comments