MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fda985a2bb6794eb54d21c5e9fa9db42c1e1be6f9861e006ea4794f5716f9c81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fda985a2bb6794eb54d21c5e9fa9db42c1e1be6f9861e006ea4794f5716f9c81
SHA3-384 hash: 921c272593a49e91dfc0c7a0e9d72b7d98ea2b3df4078acd13903b07b488e720c6b4034789d30c7c1ff2a8762e32a5c5
SHA1 hash: 5b826226f16c564caefa5b4881c67a44be46cf20
MD5 hash: 46f4b7f6800ebf6dfd0b61203b09e20d
humanhash: spaghetti-johnny-video-south
File name:USD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'281 bytes
First seen:2020-05-27 08:22:35 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:2hDfHLU8GSEtRopNfL13CWeUWXrI09Qqv3T3uH/ZFjx9U1VoY99tE/5BbVtgC:2lfHLFrCoNjJCdUWcQQqv3UxC3o0KJL
TLSH CA84231D11716836875FA8670FC689B1E8FAFE6183DC3B23EC75027269D40106BEE679
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: posta.pleksus.com.tr
Sending IP: 31.6.82.99
From: vakifleasing <nilgunuyumaz@turkperio.org>
Subject: AW: swift doc
Attachment: USD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.z (contains "USD SWIFT _SCAN TT 190617_2019-NLCIV000003576_ES146009_30309679.exe")

AgentTesla FTP exfil server:
ftp.connectus-trade.net:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 08:37:24 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z fda985a2bb6794eb54d21c5e9fa9db42c1e1be6f9861e006ea4794f5716f9c81

(this sample)

AgentTesla

Executable exe 4eb4df7be56c9700673c9a8feab57b91cef5a6adb25d1f1f1723999a1f23e219

  
Dropping
MD5 3b1aeedfe0438c9598cea56cfc811716
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4eb4df7be56c9700673c9a8feab57b91cef5a6adb25d1f1f1723999a1f23e219

Comments