MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e99f92ffd4eec405bae68524bc4f8b21c03b284c663e53a6d717cf80f66da602. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e99f92ffd4eec405bae68524bc4f8b21c03b284c663e53a6d717cf80f66da602
SHA3-384 hash: 172ea9e0b2187c0d1953b05c9de9742208124fccca9a8e33e61dbe6df8a1c16c11c1779a104bee343d28a3b7c5707fec
SHA1 hash: 83412ad87bda55a0d7f21b7d9ff69ee0e98e936d
MD5 hash: 5d36fb44b5bf4408256a111a68d77741
humanhash: timing-one-delta-pizza
File name:Payment Swift 8379393MT.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:397'839 bytes
First seen:2020-07-07 05:38:51 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 6144:UnRQm1HNgSDDsdcxIyo0TT6JnEIEsNWyWjNLRWXyb5w0YrUHgrauNhHjhJ:qS29Lx/yEs8FWXuDE/r/hj3
TLSH AE842357792804E841B2FE61841C5A01C42EB89E693CFFF84C735A577E96EC99EE9F00
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "MS. NOEMI IGNACIO" <centcorp@cyber.net.pk>
Subject: Balance Payment Prof
Attachment: Payment Swift 8379393MT.r01 (contains "Payment Swift 8379393MT.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e99f92ffd4eec405bae68524bc4f8b21c03b284c663e53a6d717cf80f66da602/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 20:06:25 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5gpzf76u53caloxgquslyt4lehadwkcmmy7fhjwxc7hyb5tnuyba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 e99f92ffd4eec405bae68524bc4f8b21c03b284c663e53a6d717cf80f66da602

(this sample)

AgentTesla

Executable exe 70ec219c395c643882ed26e21757a273a3ca5072b54934c8cbe17cb6809b31eb

  
Dropping
MD5 890164dbea449802a6ed3599d21b55cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70ec219c395c643882ed26e21757a273a3ca5072b54934c8cbe17cb6809b31eb

Comments