MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e06981ecb4d5b03e8abafcf4b69799b01605f9644693f514fe91804f7b78e50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e06981ecb4d5b03e8abafcf4b69799b01605f9644693f514fe91804f7b78e50
SHA3-384 hash: 5cacf160a5740a25c914d1dbe52c2f72667a601293a8079b82e5d461b41b9d8a3814ef9319b493dc4cc1ee1e09e38afc
SHA1 hash: 8071fdee322d3df60e9bf648d1684c2de6edb021
MD5 hash: b6a0af969566b9ba2cd062689d4e88c0
humanhash: kentucky-twenty-venus-ceiling
File name:swift 03120220231.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:756'388 bytes
First seen:2022-03-02 07:53:08 UTC
Last seen:2022-04-20 09:53:46 UTC
File type: r09
MIME type:application/x-rar
ssdeep 12288:TCd/ps7be9XAz5PP7UP1bzY1cSyOPzDHuXPnrzrSC3Lo3/rDeg77BD:TqxqCX0JP7eY11ySDg/rvq3/r/7VD
TLSH T19CF43399FE3070DB6B23B2AC73A6087E1BD335451E52720815EE5AD4BE1583B67236F0
Reporter cocaman
Tags:AgentTesla r09 SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "SAK <jventas@pucoma.com>" (likely spoofed)
Received: "from pucoma.com (unknown [185.222.57.88]) "
Date: "2 Mar 2022 05:34:36 +0100"
Subject: "RE: Payment Copy"
Attachment: "swift 03120220231.r09"

Intelligence

File Origin
# of uploads :
2
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/621f229e0cd58dbd92610181/reports/50c7ab8b-f31a-4950-a97c-3c4a7d0cf110/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e06981ecb4d5b03e8abafcf4b69799b01605f9644693f514fe91804f7b78e50/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-02 07:54:12 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
12 of 42 (28.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fydjqhwljvnqh2flv7huw2lztmawax4wirut6ukp5emaj55xrzia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e06981ecb4d5b03e8abafcf4b69799b01605f9644693f514fe91804f7b78e50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 2e06981ecb4d5b03e8abafcf4b69799b01605f9644693f514fe91804f7b78e50

(this sample)

AgentTesla

Executable exe fcfa3e25921c401d956ee669cd7612dccae1fc7772673b39d395f476d49ca1fc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fcfa3e25921c401d956ee669cd7612dccae1fc7772673b39d395f476d49ca1fc

Comments