MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 390a81f1e882ad6f32a370f1bd4db3804d88567537f77457f1584a2c090e3dc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 390a81f1e882ad6f32a370f1bd4db3804d88567537f77457f1584a2c090e3dc4
SHA3-384 hash: d4d0f5ee773c747f8d7189994a6eecd53e918746e96d9447c44c095590ae05a2fa6b10a27590d7f601264fe60add34a4
SHA1 hash: 4475d19c12fdbca4cf47f2fe828f3965b4935840
MD5 hash: b9a2581d013f7f25800e1f43747c8297
humanhash: venus-stairway-angel-delaware
File name:Swift_Copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:576'160 bytes
First seen:2021-04-08 10:10:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:YhckmiNYdjaPiuA3rUyfYP0z3WIWTShS7QRmMTh58Y3Ab:+6I23I9tpuQ7qm1
TLSH 43C423A4B3D5F450ED2B4E3A0D02ABF89D6EF0BB91449DCD91F14A8CE4D58E077B2522
Reporter cocaman
Tags:AgentTesla rar SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: ""Sunny Nie "<sales1@lekingwellness.net>" (likely spoofed)
Received: "from lekingwellness.net (unknown [180.214.239.97]) "
Date: "8 Apr 2021 03:09:27 -0700"
Subject: "Swift Copy"
Attachment: "Swift_Copy.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/390a81f1e882ad6f32a370f1bd4db3804d88567537f77457f1584a2c090e3dc4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 10:11:07 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hefid4piqkww6mvdody32tntqbgyqvtvg73xiv7rlbfcyciohxca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/390a81f1e882ad6f32a370f1bd4db3804d88567537f77457f1584a2c090e3dc4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 390a81f1e882ad6f32a370f1bd4db3804d88567537f77457f1584a2c090e3dc4

(this sample)

AgentTesla

Executable exe 96259c3b83002e4a46a66a27f0f8510c96359055bd7d9c1f8a723a1f21d71c9c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96259c3b83002e4a46a66a27f0f8510c96359055bd7d9c1f8a723a1f21d71c9c
  
Dropping
AgentTesla

Comments