MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de0be4c8498a923cd4cde4518bea271c599b77b778c7ff80b59572b17dcad4fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de0be4c8498a923cd4cde4518bea271c599b77b778c7ff80b59572b17dcad4fb
SHA3-384 hash: 11f00482d7fc4f788cd7a0ee9f831324ef2d30cf674b974612e73a1984aaa263e3cb59b958ab9c20b5a3569de05f18bd
SHA1 hash: a7426c17386d5faab65e48e90588bb8c0fbe7a3c
MD5 hash: c34f73b39c86237dbbf654b9b01ed09d
humanhash: mountain-winner-seven-lithium
File name:SWIFT COPY.pdf.r07
Download: download sample
Signature AgentTesla
Create hunting rule
File size:945'291 bytes
First seen:2020-05-27 07:50:51 UTC
Last seen:Never
File type: r07
MIME type:application/x-rar
ssdeep 12288:PRmctI/IKbvLNCZJ0Ic6NHD++K1cHHJkCiXAAFHRPC8sZdsmWtSSWpFhqsDUed3P:P8LNu0Ic6N5H6XKZfaPOqXe3VfJ
TLSH 1415335C5BC25BECADFA37AAC7E4A94D02D6697460617802CECF05F9231AC135BEC12D
Reporter abuse_ch
Tags:AgentTesla r07


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se4i-iad1.servconfig.com
Sending IP: 173.231.241.39
From: Chief financial Officer <info@marahotels.com>
Subject: RE: foreign payment
Attachment: SWIFT COPY.pdf.r07 (contains "SWIFT COPY.pdf.exe")

AgentTesla SMTP exfil server:
smtp.coffiices.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:12:52 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r07 de0be4c8498a923cd4cde4518bea271c599b77b778c7ff80b59572b17dcad4fb

(this sample)

AgentTesla

Executable exe 70ae7d332518e59f1b7a0269af475bf2881030ddb990ff6452a295e925df67de

  
Dropping
MD5 ec8fc8d6d9b25b369b9daa80f65f9551
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70ae7d332518e59f1b7a0269af475bf2881030ddb990ff6452a295e925df67de

Comments