MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b1f595a513a5d5829d54c0fec28759a7bcefb77ece9aae7dcff4fd8309a8c72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b1f595a513a5d5829d54c0fec28759a7bcefb77ece9aae7dcff4fd8309a8c72
SHA3-384 hash: 56876fc9d4c9cf91511a02af1a76d10d40a4401f341578c7de63e2782199b5bd12be07c6f597964a453aedf7fcb741fd
SHA1 hash: bd0aba2370b513b64a891dfe1fa2be963cff9fe6
MD5 hash: 5403c896419d1fca569929d9bcad2688
humanhash: wolfram-mountain-kilo-timing
File name:SWIFT_00931672020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'814 bytes
First seen:2020-05-07 12:21:43 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:H8sE/DTOo1i15NL7upvlMjIrrkcvs1qbZ8G5yK3DL:H8P/Wii1HL7WviKkTeVdL
TLSH 41A423CB5B1FFF5BD256B982F98238681A208FDFD3546422D08EFD631C056DA95C2C16
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

Sending IP: 209.17.115.117
From: rani.tarabey charismagroup.tv <rani.tarabey@charismagroup.tv>
Reply-To: rani.tarabey charismagroup.tv <rani.tarabey@charismagroup.tv>
Reply-To: rani.tarabey charismagroup.tv <rani.tarabey@charismagroup.tv>
Subject: RE: SWIFT PAYMENT OF IN00931672020
Attachment: SWIFT_00931672020.gz (contains "SWIFT_00931672020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 12:36:34 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
18 of 47 (38.30%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmpvswsrhjovqkovjqh6ykdvtj54563x5tu2vz6475h5qme2rrza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 8b1f595a513a5d5829d54c0fec28759a7bcefb77ece9aae7dcff4fd8309a8c72

(this sample)

AgentTesla

Executable exe 870fe6b4452b111da70a75632e46487b3ddfb7a247fc8a4ec6a727089cef49c2

  
Dropping
MD5 9194c2c0fd5f5ecd46dcefe7cd3aee79
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 870fe6b4452b111da70a75632e46487b3ddfb7a247fc8a4ec6a727089cef49c2

Comments