MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b3a47d151d9af3fae1ec6381568f640bdad7bf99ccd603e10e120e13588cf13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b3a47d151d9af3fae1ec6381568f640bdad7bf99ccd603e10e120e13588cf13
SHA3-384 hash: 1176699a1c69f1715a803ba1a3ba2d5748cd5723e0e129974d83c60d0078abe26108c7a3899e94381d7966b3fb1915d0
SHA1 hash: 5ba73172db9d5842cc4733065b8614e368f7a211
MD5 hash: def61763485b123959153d6cb99f92c7
humanhash: violet-maryland-nitrogen-fruit
File name:swift0.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:360'073 bytes
First seen:2020-05-13 06:05:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2iB0E2CDHK6uUALp5A2tNVJaofpQAwGi4M6Eb0YbuC/SyNPBQ+WetP3H:2qBVzKp37jVbQoFwuPyxBQ+WGPX
TLSH 3F7423E5785B08C6AB297EB220FD7C727075E2435E170678D084A2B9C784D87F647CE9
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: iix85.rumahweb.com
Sending IP: 103.247.11.216
From: Sanjay Kumar <sanjay11@bdhme.xyz>
Subject: RE: INV #47001277710401 Bank Swift Copy 20200507
Attachment: swift0.zip (contains "swift0.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 17:21:55 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lm5epukr3gxt7lq6yy4bk2hwic62267zttgwapqq4eqocnmiz4jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5b3a47d151d9af3fae1ec6381568f640bdad7bf99ccd603e10e120e13588cf13

(this sample)

AgentTesla

Executable exe fd3e7cf14c4d59ab85987afea83626e4dc0c3ee321d869b5bf94c0de69db0e5c

  
Dropping
MD5 aad3e234b005723a6641d10a66342d80
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd3e7cf14c4d59ab85987afea83626e4dc0c3ee321d869b5bf94c0de69db0e5c

Comments