MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e87b346a773fe66f829b839da905860c6ae765e5f09d1d5ed19613fdf08c1ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e87b346a773fe66f829b839da905860c6ae765e5f09d1d5ed19613fdf08c1ac
SHA3-384 hash: decb39f2f3dcbbe54f6a48d085d8d3f95c4de08dc3228b50c5a0cfcbf5185037272514dfc9311cc9b3ba39f6fa27f446
SHA1 hash: a2d2d0b1d1ad1d177f0468ad8926eb71894ae59b
MD5 hash: ddcc56e982f2e02918ccd8eef98258f8
humanhash: cardinal-carpet-batman-bacon
File name:TT DOC SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:402'805 bytes
First seen:2020-07-10 07:03:04 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:7XYTKdlA4EYFFHKuWf3VPVbcZZdyNZWaap2cyHvU7Y73or9jRhgfoZNGizkmbUBw:7De43HKuWfBZxa7y3732ngfoZD43MRx
TLSH 8B842316EF97DA0D1C17263259E2EB588AEEBE1EFC9748501AD3E323F48574E6CC1421
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lasfragancias.com
Sending IP: 200.110.77.218
From: R2_SSC Russian <xquicentro@lasfragancias.com>
Subject: Aw: Swift
Attachment: TT DOC SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.z (contains "TT DOC SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe")

AgentTesla FTP exfil server:
ftp.rebu.co.rw:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e87b346a773fe66f829b839da905860c6ae765e5f09d1d5ed19613fdf08c1ac/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 07:05:05 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d2d3grvhop7gn6bjxa45vecymddk45s6l4e5dvpndfqt7xyiygwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 1e87b346a773fe66f829b839da905860c6ae765e5f09d1d5ed19613fdf08c1ac

(this sample)

AgentTesla

Executable exe a5ffa8a9df04f5c586bcfa6b8a66b84e9709b248b5832fabaf192a52695938c3

  
Dropping
MD5 b5c7a29264b4d054fa8ab1833b6f5db5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5ffa8a9df04f5c586bcfa6b8a66b84e9709b248b5832fabaf192a52695938c3

Comments