MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d2c40b35f4f1f3db13d06f3ca4d8f55c835fd0b236c005a74a1825bbb368e83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d2c40b35f4f1f3db13d06f3ca4d8f55c835fd0b236c005a74a1825bbb368e83
SHA3-384 hash: d6f896aafff8ca9ce151ca222878106f778e2f27b6ac43adb79245de4ed7930f1f6769d72c90014dc4e2f86de95c70ae
SHA1 hash: 10a37b2763e575562c498250366c45b2b4c57cd7
MD5 hash: c3c3b640d004e52ca3467e68f6bf073c
humanhash: magnesium-ceiling-california-mirror
File name:SwiftTransferencia04.07.2020_0.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:411'683 bytes
First seen:2020-07-06 09:09:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ao9rl/xYTj1NtjdtS81JANTkPBAdT6X6ekTOcf:DZlQdtSuA5WBAJU6ekaW
TLSH 959423874B74055F9CB68096E3F4DF8AE7DACAE0B36AC679904D8C781801A85364CEF5
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: msa-smtp10.hinet.net
Sending IP: 168.95.6.60
From: Aurora Yaosca <cis@seskimya.com.tr>
Subject: Outstanding Balance payment
Attachment: SwiftTransferencia04.07.2020_0.rar (contains "SwiftTransferencia04.07.2020_0.exe")

AgentTesla FTP exfil server:
ftp.ciftci.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d2c40b35f4f1f3db13d06f3ca4d8f55c835fd0b236c005a74a1825bbb368e83/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 09:11:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nuwebm27j4pt3mj5a3z4utmpkxedl7ilenwaawtuugbfxozwr2bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6d2c40b35f4f1f3db13d06f3ca4d8f55c835fd0b236c005a74a1825bbb368e83

(this sample)

AgentTesla

Executable exe 279ec9e302994841004b80cd18df6524250ff2af9bc6e627a32fc641b02dac08

  
Dropping
MD5 a7e346f8513dabb714dbdef118a276ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 279ec9e302994841004b80cd18df6524250ff2af9bc6e627a32fc641b02dac08

Comments