MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e5860dc4e129e5ff632edea75e8c86cf2e3ef0d503971340f79b38f0064bc23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e5860dc4e129e5ff632edea75e8c86cf2e3ef0d503971340f79b38f0064bc23
SHA3-384 hash: 1df167353ab9932dbf008a35b9397f4c4d165733ca5ae9a06b82c907cb7855f03139fe42442631808fa060c5aea576ab
SHA1 hash: f7b6f30ea809a09fd45b8c261ecfb870278484f2
MD5 hash: 8dbe6e6143583844e07d3a150a18a8e9
humanhash: uniform-wyoming-three-pluto
File name:Swift Copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'193'933 bytes
First seen:2020-06-05 13:50:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:HUJGO5eizSR+5dsNUiYXPhNJ5CRWumyavB1OycuE3zwKxbYkI:HUJLfSMvsNUiY/hNJUWZdywmI
TLSH 76453397DFC8137FEB3B7A4F1AB46B35840169C64774EB44FA2E0A4F5123686889901F
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: del.cpworldindia.com
Sending IP: 185.234.219.101
From: UMESH CHAND <fcl.doc@del.cpworldindia.com>
Subject: TT Swift Copy - Application - Outstanding Payment
Attachment: Swift Copy.zip (contains "Swift Copy.exe")

AgentTesla SMTP exfil server:
mail.13texworkbd.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20816.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 13:52:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzmgbxcockpf75rs5xvhl2gintzoh3ynka4xcnappgzy6adexqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9e5860dc4e129e5ff632edea75e8c86cf2e3ef0d503971340f79b38f0064bc23

(this sample)

AgentTesla

Executable exe 45a5f7786e3c2bcf5ffc0c4cc16e4a0d534624cc096bfd1bec6054cad0d6ae92

  
Dropping
MD5 4d6dc2778ab1f2bb454a090be1da2220
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 45a5f7786e3c2bcf5ffc0c4cc16e4a0d534624cc096bfd1bec6054cad0d6ae92

Comments