MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e4efaf45f359a131beaa6f073a3825f8f8db884c446697411dcc7e752d07a11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e4efaf45f359a131beaa6f073a3825f8f8db884c446697411dcc7e752d07a11
SHA3-384 hash: c253488cce231e18e39db3b3dddf6251eb5194c920cef78db64f8b7f13f8c010b11366a26a8b3e20a1f83f2579b31927
SHA1 hash: c1c310ba76b009af123b1c24fd812ecd84438efc
MD5 hash: a47d33532de08f52940dbfad095777c2
humanhash: pasta-oxygen-october-alpha
File name:CU SWIFT SCAN TT_190617_2019-NLCIV000003576_ES146009_30309679544.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:312'626 bytes
First seen:2020-05-11 14:50:27 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:lx2uScY1ZueAjCg8cq13t0Arqnts3Sp7xibgUzlY2kT76Bi4De:TLgceAT8carqH7xCMT764Se
TLSH 416423664C35F95842CFB81C92D76C66E1F3FAFA8712B7D6231D4E14009A276F2ED086
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lasfragancias.com
Sending IP: 200.110.77.218
From: k.deniz@vakifleasing.com.tr <fastudillo@lasfragancias.com>
Subject: AW: Documents
Attachment: CU SWIFT SCAN TT_190617_2019-NLCIV000003576_ES146009_30309679544.z (contains "CU SWIFT SCAN TT_190617_2019-NLCIV000003576_ES146009_30309679544.exe")

AgentTesla FTP exfil server:
ftp.connectus-trade.net:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 04:26:41 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bzhpv5c7gwnbgg7ku3yhhi4cl6hy3oeeyrdgs5ar3td6ouwqpiiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 0e4efaf45f359a131beaa6f073a3825f8f8db884c446697411dcc7e752d07a11

(this sample)

AgentTesla

Executable exe 277b930147a1a9d1ae7cd7e8c0d0aada874d37b23191b7cbfeb4b459e00626a2

  
Dropping
MD5 8456ff273cafe24878f13a458c573639
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 277b930147a1a9d1ae7cd7e8c0d0aada874d37b23191b7cbfeb4b459e00626a2

Comments