MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 290af6903bb9fcef841b7d0bd2659044dd9ccf661763a37fdec7d98530885677. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 290af6903bb9fcef841b7d0bd2659044dd9ccf661763a37fdec7d98530885677
SHA3-384 hash: d9f284ceb26dde6d961d63a4f907d99fa68f2164569b0ae0383480dc12838b84aa34eac0ff3151a1ca5d5f153cac0df2
SHA1 hash: 3bef20b4d2429d1dac7eb3ef3d4a0b99a1cac977
MD5 hash: c580a7ecfe7b010732589179f65f9cdf
humanhash: steak-mike-equal-tennis
File name:30% Scan SWIFT 09557875678.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'018'124 bytes
First seen:2020-06-10 11:24:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:vczFYJ+RHZBbAMy7uCE7kEnRndsgRKLezCA6RqOznQmUDtuiwXUHjwH:vKYJ+5Dbz2EL9VzV6wOznQm5ikUH0
TLSH 302533A208355B4AB00D5D62E40AECF6AE6F4B2480373B79DBF1435136995FBC2163B7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ip181.ip-167-114-177.net
Sending IP: 167.114.177.181
From: Maggi Scarlette <Maggi-Scarlette@gmail.com>
Subject: Rv: TRANSFER.
Attachment: 30% Scan SWIFT 09557875678.zip (contains "30% Scan SWIFT 09557875678.exe")

AgentTesla SMTP exfil server:
smtp.pharco--corp.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:25:06 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fefpneb3xh6o7ba3puf5ezmqitozzt3gc5r2g766y7mykmeikz3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 290af6903bb9fcef841b7d0bd2659044dd9ccf661763a37fdec7d98530885677

(this sample)

AgentTesla

Executable exe 0262d3c3b2b03ad33d112361a02cc54ae49aab91042075c2978f14cb2aec0093

  
Dropping
MD5 d432ebf2eb0bba78a1d616b6acb8e09b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0262d3c3b2b03ad33d112361a02cc54ae49aab91042075c2978f14cb2aec0093

Comments