MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40ca93c73fadcf4cbc990af2564682dcca0ee8a0084366eb58479ff503c28faa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40ca93c73fadcf4cbc990af2564682dcca0ee8a0084366eb58479ff503c28faa
SHA3-384 hash: 45972a34ad8725c5a0f226c7d897d853425f859f6b16ff2639670bbda5d4ade922af54783bb8f8820870b3be5a426487
SHA1 hash: 5f7568e3fec98116dfe97fd95374167d8ee7bf23
MD5 hash: 492b12d0351e2a1a89107215f302a6be
humanhash: south-moon-florida-monkey
File name:Swift-MT103.jar.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:336'258 bytes
First seen:2020-05-10 14:15:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:GsDh4jgPUOrkm9wiVZx157jX125OCFmXnfhORxFXmCvbAzN:GsZcOrFw+rzl2wXZKbYN
TLSH 72642320D01D48B359C379CC6EFC0DBDA5F519D229C2CFDC684AE8BB59E037A57660A8
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: safetysurveyors.com
Sending IP: 37.49.230.30
From: carla@eurotrading.bologna.it
Subject: RE: [1] Pending Payment
Attachment: Swift-MT103.jar.zip (contains "Swift-MT103.jar.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.fc.21940.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 14:35:47 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=idfjhrz7vxhuzpezblzfmruc3tfa52fabbbwn22yi6p7ka6cr6va._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 40ca93c73fadcf4cbc990af2564682dcca0ee8a0084366eb58479ff503c28faa

(this sample)

AgentTesla

Executable exe 563e34af96c4369b4947d9e96212da4bbfd63023396a44d116c60a9158a16e67

  
Dropping
MD5 081b8f7b1e835e2cdc67c976051043c9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 563e34af96c4369b4947d9e96212da4bbfd63023396a44d116c60a9158a16e67

Comments