MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2c82979e3ece319f94e2144d163dfdba34b9c0c8d0f6c0187e41d628da44d11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2c82979e3ece319f94e2144d163dfdba34b9c0c8d0f6c0187e41d628da44d11
SHA3-384 hash: e98b520a324392d71e89afe16edb48a916e1430376c555e6d7a7fad504dd7655b6d5ad2368dae2029a63a4f16cad4fd9
SHA1 hash: 14049041539291729321f154a69a0bdd890ff675
MD5 hash: 9d68ba564d8daeb1efdc36bde3521995
humanhash: south-indigo-nebraska-jersey
File name:Swift Copy.pdf.r07
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'260'459 bytes
First seen:2020-05-05 07:46:13 UTC
Last seen:Never
File type: r07
MIME type:application/x-rar
ssdeep 24576:2yUpFKOGGo0cW0JNM+chZj3sFm/Wnaf8nJUL+2NYh7yZnGPKzXW3lDFoEHFDJ9:2yONPoG9kE/WhJiNyWZGPpJfJJ9
TLSH 2F45339BFE47407ADB35621E7A2F2425A76E5226470F2A1C313360E5DBAFCB1C858CD4
Reporter abuse_ch
Tags:AgentTesla r07


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.informadsa.com
Sending IP: 88.12.20.97
From: Irizar.abogados <Irizar.abogados@irizarabogados.es>
Subject: TT- Swift Copy: 471/35/13A-2773
Attachment: Swift Copy.pdf.r07 (contains "Swift Copy.pdf.exe")

AgentTesla SMTP exfil server:
smtp.coffiices.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 08:36:22 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ulecs6pd5trrt6koefcncy673oruxhamruhwyamh4qowfdnejuiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r07 a2c82979e3ece319f94e2144d163dfdba34b9c0c8d0f6c0187e41d628da44d11

(this sample)

AgentTesla

Executable exe 6d58c8e531d65f5713f19a8caf7b6ac0f4ce25adf29a3b96aeee7de4045f409a

  
Dropping
MD5 1636f20fe61a782a77338309462293ad
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d58c8e531d65f5713f19a8caf7b6ac0f4ce25adf29a3b96aeee7de4045f409a

Comments