MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65d7995319c9d27140b2e4dcfecfb816afcd0450940c1e3cc11d18dac34a6409. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65d7995319c9d27140b2e4dcfecfb816afcd0450940c1e3cc11d18dac34a6409
SHA3-384 hash: 29f1c1764a6db9cb67d76167b49b2304c1769b2698a0263863ee911c415371827d575de587000fb0a330eb3c8522616b
SHA1 hash: 4970d637b83b8bb512bc32490fd472a707279ee6
MD5 hash: c4168c5e09fce5ef80e19fd4871fa226
humanhash: asparagus-golf-mirror-wyoming
File name:SWIFT INVOICE.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'054 bytes
First seen:2020-05-13 06:15:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:JDhuh4dITI+Sfavr48u0VYvb+WnzvzDfE:zUTI+Eaj7VAb+czvzY
TLSH C4942394F647E4C1ABEE1FBCB64DFC2658C03007D640E849BE97D884888D4B688BF647
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: topmould.co.th
Sending IP: 103.145.254.227
From: Danny Jimenez<apurchase-tm-tp@topmould.co.th>
Subject: Fwd: SWIFT ACKNOWLEDGEMENT
Attachment: SWIFT INVOICE.rar (contains "DUTov3cQ2HTd2qx.exe")

AgentTesla SMTP exfil server:
webmail.pat.ps:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:37:00 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mxlzsuyzzhjhcqfs4top5t5yc2x42bcqsqgb4pgbdumnvq2kmqeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 65d7995319c9d27140b2e4dcfecfb816afcd0450940c1e3cc11d18dac34a6409

(this sample)

AgentTesla

Executable exe 352d53b493a9cc5229ba4ae690f7c79ac3c5b5b15f3d9f8ef1b15cf84d63c438

  
Dropping
MD5 3331dd5b2fd23a427b84a7bbdcb79209
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 352d53b493a9cc5229ba4ae690f7c79ac3c5b5b15f3d9f8ef1b15cf84d63c438

Comments