MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2551af7103589ef0c6302fba59c0c3c1e1c0c500a343aa4932aca59ccc37efb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2551af7103589ef0c6302fba59c0c3c1e1c0c500a343aa4932aca59ccc37efb
SHA3-384 hash: 65c8b55cf3e99bc6cf7fa2337be1a5c6601be5ff5312a780da0e0ee7a2efc1a94c925d8fb25216a6b3a6c7d0000e64c0
SHA1 hash: 337557535a0940c404f7a72a62d096a9ddde6ef6
MD5 hash: 240a10c205c9fd62d58405518f3c7b18
humanhash: arkansas-november-zebra-nuts
File name:Swift copy.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-09 11:46:06 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:P9+Onj30sVAOxWBSRnJ/OjEKoNH03h6Ukk:M8AOxWB0/OjEqo5
TLSH 23450153339C1318C9E48E3439BC7D86371673099332A69D7A0F65BD870B73962A1BDA
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: agribau.com
Sending IP: 37.49.224.164
From: INFO<info@agribau.com>
Subject: 30% Deposit for the PI
Attachment: Swift copy.img (contains "Swift copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.941326.28498.3041.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2551af7103589ef0c6302fba59c0c3c1e1c0c500a343aa4932aca59ccc37efb/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 07:07:30 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6jkrv5yqgwe66dddal52lhamhqpbydcqbi2dvjetflffttgdp35q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f2551af7103589ef0c6302fba59c0c3c1e1c0c500a343aa4932aca59ccc37efb

(this sample)

AgentTesla

Executable exe 516b18a120eb6f6380a7df0ff52def508e3da5e79b12a60647cc438e478e3363

  
Dropping
MD5 76e2b77b8945a9d50034405c520fad02
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 516b18a120eb6f6380a7df0ff52def508e3da5e79b12a60647cc438e478e3363

Comments