MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 350b5b7edc52a6b257d7c7f39f561e054dd548fbceb8ed806ef8256e863eecaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 350b5b7edc52a6b257d7c7f39f561e054dd548fbceb8ed806ef8256e863eecaf
SHA3-384 hash: 4b8581574089959eefe3bf0cf2b5a94c67f778cd2eb14cb0374983efe9a7de0c1cf85729de1b9af239b0517a3e59512d
SHA1 hash: 57f79c90c742fe5f930092985041e86b8bdb2fbf
MD5 hash: c5f4c0a26d65f0f41754e708d19537b9
humanhash: maine-iowa-december-chicken
File name:Swift copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:260'722 bytes
First seen:2020-10-07 10:57:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:zTF8hwZ9uCpBpcOjx0pUT2SFnxFm6MoJRlRaWyv:PF8hwZ9uCR0pk20JMojmWyv
TLSH 034413BDC7E29D198E4A06D04E04E2FFC3599E6F235BC6548837628BB3590A3092DD99
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dbs.com.sg
Sending IP: 103.141.138.129
From: DBS Bank<info@dbs.com.sg>
Subject: TT- Swift Copy: 471/35/13A-2773 From DBS Bank
Attachment: Swift copy.zip (contains "Swift copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/350b5b7edc52a6b257d7c7f39f561e054dd548fbceb8ed806ef8256e863eecaf/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 09:33:08 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gufvw7w4kktlev6xy7zz6vq6avg5ksh3z24o3ado7asw5br65sxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/350b5b7edc52a6b257d7c7f39f561e054dd548fbceb8ed806ef8256e863eecaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 350b5b7edc52a6b257d7c7f39f561e054dd548fbceb8ed806ef8256e863eecaf

(this sample)

AgentTesla

Executable exe 0958b7f6561a4a4a41b051dfdabdb73e874f9656b01039fce8412abe96d98067

  
Dropping
MD5 fd0830b1f44a17f0c46356993cbdc338
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0958b7f6561a4a4a41b051dfdabdb73e874f9656b01039fce8412abe96d98067

Comments