MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64ac9751851ef3f7edb5ddc2c0a28479c2a40c0cd89b90e513f40c9923c51084. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64ac9751851ef3f7edb5ddc2c0a28479c2a40c0cd89b90e513f40c9923c51084
SHA3-384 hash: 15a8041f9218e3b64e43e94b75103bb8cac1dc6893f61a756fa8f079c4c6af47515d7f1fc32825a4082ed1f0da0d4fb7
SHA1 hash: ac8e9340632c7dc8270a8126f5852844ad386232
MD5 hash: 9bc51ee58b89c2ea994fa893cd3ae95b
humanhash: monkey-table-friend-ack
File name:SWIFT 001.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'343 bytes
First seen:2020-06-18 06:22:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:q8ZhESBeeaFLi8RwFZzNp7C5e5jGldxV0H:qMF4vLr6vCfPxI
TLSH E5942358E113F24805E9D39DE23A0A8A82F1B3753EFEAA1C519A1D7E54DC2F93E4435C
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: soundway-medical.com
Sending IP: 45.143.222.116
From: Lily Jin <lily.jin@soundway-medical.com>
Subject: Re: Overdue Invoices
Attachment: SWIFT 001.rar (contains "SWIFT 001.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:24:08 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mswjoumfd3z7p3nv3xbmbiuephbkidam3cnzbzit6qgjsi6fccca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 64ac9751851ef3f7edb5ddc2c0a28479c2a40c0cd89b90e513f40c9923c51084

(this sample)

AgentTesla

Executable exe 35bd25fc9f94e7e8bc745266b473b17b15bf5d70bf6f96e4be6765a52ef150bb

  
Dropping
MD5 bde06880567a0b7d65542ef6a237ab5e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 35bd25fc9f94e7e8bc745266b473b17b15bf5d70bf6f96e4be6765a52ef150bb

Comments