MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72b5aa45f28023e56ec724cb67bc9e9af133e5b7b3bef4318025a4d45b79a794. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72b5aa45f28023e56ec724cb67bc9e9af133e5b7b3bef4318025a4d45b79a794
SHA3-384 hash: 7115408bf08bc65874ef1d1a3a1882944e2bd7dd788e4d6c36458bcac02eb9c756cb300a6790730741605e4a24201910
SHA1 hash: 7f1e1812742515d3509f31cee2d1619e19cf4ba2
MD5 hash: 1eef91ad0c087a8a767ceb037f403f08
humanhash: nineteen-network-hamper-shade
File name:Swift_7478748989.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:742'172 bytes
First seen:2020-07-20 11:12:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:fYrRJQYM2C9SYaM6aBnYTnE+2k4qDJC0oDdL9rO5McefAyhMtWjXprBMCjuuEf9N:ArRJm2NlM6aNmvXx9oDdx6yLDvj5WCiN
TLSH 45F42392C18382B29D4FA3AEB7FB451AE3653277A613ED121E55FAF3115D8F609B01C0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: decofurnsa.co.za
Sending IP: 172.93.187.52
From: Leonard Jacobs Decofurn Furniture <info@decofurnsa.co.za>
Subject: Payment Regarding shipment
Attachment: Swift_7478748989.zip (contains "Swift_7478748989.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72b5aa45f28023e56ec724cb67bc9e9af133e5b7b3bef4318025a4d45b79a794/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 11:13:08 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ok22urpsqar6k3whetfwppe6tlythznxwo7pimmaewsniw3zu6ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/72b5aa45f28023e56ec724cb67bc9e9af133e5b7b3bef4318025a4d45b79a794

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 72b5aa45f28023e56ec724cb67bc9e9af133e5b7b3bef4318025a4d45b79a794

(this sample)

AgentTesla

Executable exe 5d5010a8adc3bce8ff071d6b084ddd50bbc416a792d7865ba48864f4801eaf51

  
Dropping
MD5 4a0fe7a32ef8b401fc6569a86cab2729
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d5010a8adc3bce8ff071d6b084ddd50bbc416a792d7865ba48864f4801eaf51

Comments