MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ea975a20bc6f43d5a5bb349a13fa3024ccc54aea6676cf54f8cce5b38314d75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ea975a20bc6f43d5a5bb349a13fa3024ccc54aea6676cf54f8cce5b38314d75
SHA3-384 hash: 9c41242b2037d8c1a4be25e17a4d9bc3d5108ac7bae003fdb63cc48c409fbf929e568415731098a00b66d8607afcf151
SHA1 hash: 05e1521ad3dbdae108bf4f2f3a7bc8de7866a380
MD5 hash: 9ec73b7041d47cd2243b1a7efd6bd602
humanhash: alpha-shade-carpet-island
File name:Shanghai Swift-103-05042020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'179'779 bytes
First seen:2020-05-04 20:31:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:73Efl05Ckpf2cBoXPE/8h6xjv3RKfhHysXbr8Tk+SOyQrdqU4T70gRN6:73MlOcPlwxLRqSsrIryHdf0f
TLSH 784533CE63CD5180BE1D869437A99D8758BD7BF11286F72AB50FB7E6890F813F4A4009
Reporter abuse_ch
Tags:AgentTesla HSBC rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.true.co.za
Sending IP: 196.15.196.92
From: HSBC ADVISING SERVICE<092837774-0838-admin@hsbc.com>
Subject: Payment Advice - Advice Ref:[GLV330567637] / Priority payment / Customer Ref:[209TRAPA00079338] 付款通知書 - 通知書參考編號 Ref:[GLV330567637] / Priority payment / 客戶參考編號
Attachment: Shanghai Swift-103-05042020.rar (contains "Shanghai Swift-103-05042020.exe")

AgentTesla SMTP exfil server:
smtp.telenor-com.xyz:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 06:06:56 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2uxliqly32d2ws3wne2cp5dajgmyvfouztwz5kprthfwobrjv2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7ea975a20bc6f43d5a5bb349a13fa3024ccc54aea6676cf54f8cce5b38314d75

(this sample)

AgentTesla

Executable exe d538d152eca8c888d8f572fc489d1b2f7a25bc95c80a2f6432124ea5d9c24492

  
Dropping
MD5 3e6e96b0264bd407d869fb83babd1619
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d538d152eca8c888d8f572fc489d1b2f7a25bc95c80a2f6432124ea5d9c24492

Comments