MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92653b51a0203ee23ddbdad81644300acc4397acac7bd6f7be1d3024702833d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92653b51a0203ee23ddbdad81644300acc4397acac7bd6f7be1d3024702833d5
SHA3-384 hash: 1d57360a72e4361a034adefca7733aaaf1455d9cd19c72e2a4c5321c6de5b483a011db5eb1891d9e85839309fe5502fb
SHA1 hash: 1bbd9586ebb95506fd0ceb606e11239df18c3731
MD5 hash: 87cfa1230d30a8e1996f461d2f470437
humanhash: september-mirror-fanta-arkansas
File name:swift copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'463 bytes
First seen:2020-05-19 06:52:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:kQkL+mRLV66Ha4Ct13mNHCPbm9dbiWNCs/f:lI/RLMVtz+biHs3
TLSH EF942359FE6B32B187A8ED9B172E852CD333701540C511FE4B0AE30A9AEB47494ACDDD
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: ChemieBrunschwig@spin.it>, info@brunschwig-ch.com
Subject: Re:Urgent! confirmation of Invoice/payment
Attachment: swift copy.rar (contains "swift copy.exe")

AgentTesla SMTP exfil server:
1st-ship.com:587

AgentTesla SMTP exfil email address:
snp@1st-ship.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 09:25:46 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sjstwunaea7oepo33lmbmrbqblgehf5mvr55n556duyci4bigpkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 92653b51a0203ee23ddbdad81644300acc4397acac7bd6f7be1d3024702833d5

(this sample)

AgentTesla

Executable exe 93d5e54bc0eedf04d893416ef597e0c833c7d7870f9f793fdd7e5f1b23382273

  
Dropping
MD5 10c3fadf5d9d5443634c1091644064f9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 93d5e54bc0eedf04d893416ef597e0c833c7d7870f9f793fdd7e5f1b23382273

Comments