MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28039640317793b0935df005d4753f1fc822b5922164796b94c2f8c9ebae82a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28039640317793b0935df005d4753f1fc822b5922164796b94c2f8c9ebae82a3
SHA3-384 hash: 52c407165c0029d8c7021a09d2edb3c2000548d8c473a1727a72bd2addefac729a953f04115909bd967bc17493cdef76
SHA1 hash: 1a1265ef9efaad60fff79bc08bd602c95ab46621
MD5 hash: 337e6d30a9e0b2453a93ff5059b33c53
humanhash: neptune-robert-nevada-alaska
File name:SWIFT 001.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:433'305 bytes
First seen:2020-06-15 05:35:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:BbgbSjdQbEKlsUtiyTOpgsvcqaWavEUHMM:S6dsEfUtiMOpgCZUsM
TLSH D494235583E446F919D2135B153BF0A234833F0B198CE78765191ECEB3D82BEAD83B5A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pro21.emailserver.vn
Sending IP: 103.15.48.241
From: chaupm@newbev.vn
Subject: RE: PAYMENT ADVICE - TELEGRAPHIC TRANSFER NO. M88SI1808BU00250
Attachment: SWIFT 001.rar (contains "SWIFT 001.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:37:05 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fabzmqbro6j3be256ac5i5j7d7ecfnmsefshs24uyl4mt25oqkrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 28039640317793b0935df005d4753f1fc822b5922164796b94c2f8c9ebae82a3

(this sample)

AgentTesla

Executable exe f98b5f9ffaf0a7c0cf9ee0d77362bacba4db7882cca9d61cab279d50fc57f483

  
Dropping
MD5 20b5c239947937cc3edc79dbd62cf8a1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f98b5f9ffaf0a7c0cf9ee0d77362bacba4db7882cca9d61cab279d50fc57f483

Comments