MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccd439e75abd84012a390c5c708908a8d7306fd17fde2596799356d1a41d3418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccd439e75abd84012a390c5c708908a8d7306fd17fde2596799356d1a41d3418
SHA3-384 hash: b99df64161c389411b26325098ad70c9d07fa1ddeb2448125278d6e44b3fc0573443cd1176e2e6fad57b196c1900088f
SHA1 hash: 51c31523ffa67fc7b775ad2e819f41c5a9f1ebba
MD5 hash: cec45fbae87ad9344a0e3d9c573764c1
humanhash: one-bravo-football-wisconsin
File name:SWIFT_COPY_FORURGENT_RESPOSNSE_sw356388838.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:908'941 bytes
First seen:2020-06-08 16:50:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:StAk7867YpjTRBgPN+TSOAgfFtIkVS7x7J:S/TgjFByggsFthE9J
TLSH F0152374B141A4EF52A6E1ABC328D847825294CF7C6FE7987471C2634E47BE1DD2B708
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail2951.orhamadan.com
Sending IP: 62.75.255.150
From: Nylene Criste <info@mail2525.himayadar.org>
Subject: NEW_PURCHASE_ORDER
Attachment: SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.rar (contains "SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe")

AgentTesla C2:
https://radiokerigma.com.br/inscricao/fonts/webpanel/inc/f7fd75df663d82.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 16:52:05 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ztkdtz22xwcackrzbrohbciivdlta36rp7pclftzsnlndja5gqma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ccd439e75abd84012a390c5c708908a8d7306fd17fde2596799356d1a41d3418

(this sample)

AgentTesla

Executable exe 07b55ae89038136fc1da21d2aaea7b9e6d17ea18843d26f9bbcad7124eb5f1be

  
Dropping
MD5 2fc3fdaeda173710cb9a6bb5e8a993d8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07b55ae89038136fc1da21d2aaea7b9e6d17ea18843d26f9bbcad7124eb5f1be

Comments