MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45a87ac351c18a1646d5117d6d09637cd1b2142db25305171e7aeb91f3bcc929. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45a87ac351c18a1646d5117d6d09637cd1b2142db25305171e7aeb91f3bcc929
SHA3-384 hash: 9fb16816fac310dc22a2c556576c942c0aaa3ef3568d1ef5305174fd1f6fa08aee4bd561fe1e883f8c0f74959b3d522a
SHA1 hash: 9673c6097a6cec914011ce4e78406351bb8db22a
MD5 hash: 55c1b3934ef6dc3210beb52023cf0e67
humanhash: hamper-mars-oven-pluto
File name:USD GD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'217 bytes
First seen:2020-05-24 08:58:07 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:PW70p/g2kc+kfbqPAHfHJaP/xhn0+YVJ0hGJD9RsV:TIiDqYHfHEPf0D4V
TLSH D68423CB9282DA475B83DE7440ED0FDBB7DAC583DA2868D1B73D6F2C8854368C9C2159
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lasfragancias.com
Sending IP: 200.110.77.218
From: Vakifleasing <info@barbieri-belts.com>
Subject: AW: swift
Attachment: USD GD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.z (contains "USD GD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.exe")

AgentTesla FTP exfil server:
ftp.kokobg.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 09:35:33 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 45a87ac351c18a1646d5117d6d09637cd1b2142db25305171e7aeb91f3bcc929

(this sample)

AgentTesla

Executable exe 9c7de3ee27b215261465577ad0cd4bb55ce06dd1139e5146bfed9386635b4ef8

  
Dropping
MD5 35a4639e2ee9e19d99693b8ebd06a4c9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c7de3ee27b215261465577ad0cd4bb55ce06dd1139e5146bfed9386635b4ef8

Comments