MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a32985f361dbc99db68d2daa0507dbe5dc9aaf5792e93ea2e03e90f9a5f3aace. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a32985f361dbc99db68d2daa0507dbe5dc9aaf5792e93ea2e03e90f9a5f3aace
SHA3-384 hash: 2f65d7fd519d34645ee846a6f789db6b82afc338d29f4dbaa90c3cf3c0bccae90794077ceeab23b4a705085d889b73c6
SHA1 hash: c9d3a11b4ffa440b9cdab04e0b6e00910f15a8d1
MD5 hash: 019c93a2715bdf2a671068dc942950b4
humanhash: batman-magnesium-happy-maryland
File name:SwiftTransferencia02.07.2020_0.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'169 bytes
First seen:2020-07-03 18:00:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:oM7ZiYQeC6GV8aSTMQHk5JYqstPLpv2W0jaKeuGLmdycsi9NL29f3iM+R0NUC:hZixLr8aeMkftlCel+Fsi9NL6f3RuC
TLSH 5784231DA508F224EF5C53ECDFE84156AB7D49851EADA08FE5C054A3E823F764A0B2D3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.ideay.net.ni
Sending IP: 186.1.31.37
From: Rodolfo Lorenzo <accounts@dielectroindustrial.es>
Subject: Transferencia SWIFT de pedidos pendientes
Attachment: SwiftTransferencia02.07.2020_0.rar (contains "SwiftTransferencia02.07.2020_0.exe")

AgentTesla FTP exfil server:
ftp.ciftci.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a32985f361dbc99db68d2daa0507dbe5dc9aaf5792e93ea2e03e90f9a5f3aace/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 18:02:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=umuyl43b3pez3nunfwvakb634xojvl2xslut5ixah2iptjptvlha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a32985f361dbc99db68d2daa0507dbe5dc9aaf5792e93ea2e03e90f9a5f3aace

(this sample)

AgentTesla

Executable exe c70115af42fcb154ccb1e348ee9a233e46ea70c6c7ac589bdeeb9e6cf47a7f79

  
Dropping
MD5 3c871a093c78ff77ed0417b107ad1755
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c70115af42fcb154ccb1e348ee9a233e46ea70c6c7ac589bdeeb9e6cf47a7f79

Comments