MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64ad7dcfbbb366d63a8cd651a970e865f348ab8904633bb2a8c61820e809f6c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64ad7dcfbbb366d63a8cd651a970e865f348ab8904633bb2a8c61820e809f6c4
SHA3-384 hash: 5ed84254f75d09d117b30d6ee96fcd0c0cba527cdc992f550273d31b216c65d47aaadb35330a91bb2e02e06279742cef
SHA1 hash: 3e6951455da2204a1c709bbc699b13e28ef02203
MD5 hash: d19f0d2ad871b7a33913f0a09dfb8cca
humanhash: seventeen-ink-lemon-maryland
File name:INGBANK swift.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'513 bytes
First seen:2020-06-19 12:18:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:J060nIxukbSaIuY3Rub6WA0NgiLAjiDD2DPIkLWMNLKb46tBm1j:y6GIozzlsWcFqe0wkLWSmtoR
TLSH 398423C3145450F983137E0706D7A24418AD165207DFCB8CDAAC9FDCDA99EAB9EEC4B2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server1.bluecloud.jo
Sending IP: 81.95.158.149
From: <bs@sioufi.sscc.edu.lb>
Subject: FW: PAYMENT CONFIRMATION
Attachment: INGBANK swift.zip (contains "INGBANK swift.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.c1dd65dc9d8d1861.9824.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 12:20:05 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mswx3t53wntnmoum2zi2s4himxzurk4jarrtxmviyymcb2aj63ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 64ad7dcfbbb366d63a8cd651a970e865f348ab8904633bb2a8c61820e809f6c4

(this sample)

AgentTesla

Executable exe d591ea0891e677d3c0991203972b9c6af838141870be6b90cb129bde73953f5e

  
Dropping
MD5 0a569a3d4219389810a708e1360827ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d591ea0891e677d3c0991203972b9c6af838141870be6b90cb129bde73953f5e

Comments