MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c304539aaae455f54a6a9530348770af4b9f2edddf24ff6bd4a899e456786088. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c304539aaae455f54a6a9530348770af4b9f2edddf24ff6bd4a899e456786088
SHA3-384 hash: db097bc82a0c5627bb37f4fe734dbef5f8762866f6b0110eef278cc4e0dee3d81ae80fead5f1de24830c94f3acffc487
SHA1 hash: 771c095fa5f28021890ed914e1b8466dbe1b82de
MD5 hash: cdc081ab06f0177c96480921c0cfe4c2
humanhash: timing-utah-fix-sink
File name:SCAN SWIFT TT_679388190617_2019-NLCIV000003576_ES146009_3030679.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:361'699 bytes
First seen:2020-07-21 06:36:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:eeFf5PUQdfW9fjwR8uMxsUkF+hIBYjM/+TccD7DtBTpUFEAVT6:eed58sAsR8dECI6ZDnbTKFa
TLSH 40742359AE65099B813E59B077A3E43B97CBE880D0C0453ACD6AE917DECCB8474124FD
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.sunflowerpack.ga
Sending IP: 192.241.166.174
From: VKfinance <info@sunflowerpack.ga>
Subject: AW: Swift
Attachment: SCAN SWIFT TT_679388 190617_2019-NLCIV000003576_ES146009_3030679.xz (contains "SCAN SWIFT TT_679388 190617_2019-NLCIV000003576_ES146009_3030679.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c304539aaae455f54a6a9530348770af4b9f2edddf24ff6bd4a899e456786088/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 03:05:53 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymcfhgvk4rk7kstksuydjb3qv5fz6lw534sp626uvcm6ivtymcea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c304539aaae455f54a6a9530348770af4b9f2edddf24ff6bd4a899e456786088

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c304539aaae455f54a6a9530348770af4b9f2edddf24ff6bd4a899e456786088

(this sample)

AgentTesla

Executable exe 28389362e55f86df21dd5220337ac35d89b955ae688950de5389a76c75561620

  
Dropping
MD5 036da992cc08012e717eb8ad653c43bb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 28389362e55f86df21dd5220337ac35d89b955ae688950de5389a76c75561620

Comments