MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69650720ac01252d16535518d52b2128ee46856d4e2fea37193227ff44d3274b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69650720ac01252d16535518d52b2128ee46856d4e2fea37193227ff44d3274b
SHA3-384 hash: 5a99bd73e01cb602da7fcbf8f42f763e8cf7e0ac6651edd693b2c9946806f2a2949daa40d583ca3a3e537c434aa2ef58
SHA1 hash: 685055a9fd799e6b1155683afbb7d856c96b8aaf
MD5 hash: d7f29e91bc9f224a37cae399aa4363f6
humanhash: missouri-zulu-yankee-arizona
File name:Fauur 893454o..img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:924'602 bytes
First seen:2021-03-18 06:23:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:NsHPoA5Xn7LWMGeOrwvp+38T/Erba6mtRr:SvrXOMdp2I8NS1
TLSH D71523F37A19461DCC1364E6F9422EAB172B45A165D6CCAD24C0F38B91BFDC08B72D4A
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Sales@bigeastequipment.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.107]) "
Date: "17 Mar 2021 21:51:24 -0700"
Subject: "=?UTF-8?B?5LuY5qy+5Y+R56WoXzg5MzQ1NA==?="
Attachment: "Fauur 893454o..img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_Hideexe.5.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Trojan.VBGeneric-6735885-0
Create hunting rule

Win.Virus.Sality-6747602-0
Create hunting rule

Win.Malware.Swisyn-7610494-0
Create hunting rule

Win.Virus.Sality-6335700-2
Create hunting rule

Win.Trojan.Kazy-304
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/69650720ac01252d16535518d52b2128ee46856d4e2fea37193227ff44d3274b
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69650720ac01252d16535518d52b2128ee46856d4e2fea37193227ff44d3274b/
Threat name:
Win32.Trojan.Swisyn
Create hunting rule
Status:
Malicious
First seen:
2021-03-17 20:42:14 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
37 of 47 (78.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nfsqoifmaess2fstkumnkkzbfdxenblnjyx6unyzgit76rgte5fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 69650720ac01252d16535518d52b2128ee46856d4e2fea37193227ff44d3274b

(this sample)

AgentTesla

Executable exe 863e79eefbefca07f2b0ff5689d6421ab1ec334b19466e066c744a8ad8495ad6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 863e79eefbefca07f2b0ff5689d6421ab1ec334b19466e066c744a8ad8495ad6
  
Dropping
AgentTesla

Comments