MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1409077a2da04a44691369ce85eba911b405c21cc49c0b13f7fe2c3a9c3db90c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 1409077a2da04a44691369ce85eba911b405c21cc49c0b13f7fe2c3a9c3db90c
SHA1 hash: 4a2a636a43b48165bc790226aa71003f0707fa73
MD5 hash: 4c072ce07dc2db184a92acfbfce03b80
File name:SWIFT.rar
Download: download sample
Signature AgentTesla
File size:423'693 bytes
First seen:2020-05-23 11:18:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:QuUgg3KhZkQpxePLWXcBebmu5QZjv9b/gPyybX:3Zg3KhZkQpxePL79Mc5/1y7
TLSH 5094233E4FE034ED7F6A7643A476F0C8220D9707D37821D956E8DA22A55890B1DEE93C
Reporter @abuse_ch
Tags:AgentTesla rar


Twitter
@abuse_ch
Malspam distributing AgentTesla:

From: "mBank S.A." <powiadomienia@mbank.pl>
Subject: mBank S.A. - transaction confirmation
Attachment: SWIFT.rar (contains "SWIFT.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence


Mail intelligence
Trap location Impact
IT Italy Low
Global High
# of uploads 1
# of downloads 19
Origin country US US
ClamAV No detection
VirusTotal:Virustotal results 32.20%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1409077a2da04a44691369ce85eba911b405c21cc49c0b13f7fe2c3a9c3db90c

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments