MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8b80f929fc91b93ed9f4381cdc275b3846354da266b9ded555157f7c7c15fc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8b80f929fc91b93ed9f4381cdc275b3846354da266b9ded555157f7c7c15fc1
SHA3-384 hash: 1fd2805e3b97f8f6f58ba73e77956003e57f5e3669cc4f57492b92fb954b97288e70c58033ddf360a93ccaf659db91a3
SHA1 hash: 8219d501b52d5d1d1681a296dbf38a88e7e19d8f
MD5 hash: c3e8ab0de441172c7157fae99a3c4180
humanhash: cat-lima-glucose-eighteen
File name:Swift copy.pdf.. 2.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:482'408 bytes
First seen:2020-07-29 10:34:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:F2aq5af+IHMlJV1+eV7mb1syjM2WPl3gQ5bsPLH4/mV:3qImImV1j7mb1syjCawa
TLSH 3CA4237E312ABC402DAAF92661D5404F27679AFF1CD1E51902B1CB7F2B188BA4C2419F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: chinabank.ph
Sending IP: 103.99.1.143
From: "JEFFERSON G. CAPISTRANO"<jgcapistrano.cbs@chinabank.ph>
Subject: RE: Payment Advice -SWIFT Transfer (103)
Attachment: Swift copy.pdf.. 2.rar (contains "Swift copy.pdf.. (2).exe")

AgentTesla SMTP exfil server:
mail.stankovic.hr:587

AgentTesla SMTP exfil email address:
info@stankovic.hr

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8b80f929fc91b93ed9f4381cdc275b3846354da266b9ded555157f7c7c15fc1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 07:28:22 UTC
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3c4a7eu7zenzh3m7ioa43qtvwocggvg2ezvz33kvkfl7pr6bl7aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d8b80f929fc91b93ed9f4381cdc275b3846354da266b9ded555157f7c7c15fc1

(this sample)

AgentTesla

Executable exe a63ac2c19153c340a54a2be27ac53722f5c5a653fd851b32931add8fe353c6c3

  
Dropping
MD5 d6f16dcc168e50d0f56ab75145967baa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a63ac2c19153c340a54a2be27ac53722f5c5a653fd851b32931add8fe353c6c3

Comments