MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74887b9b272ae5164770280337d67c87a3580c2988737dc72d5b0a219f2fee24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74887b9b272ae5164770280337d67c87a3580c2988737dc72d5b0a219f2fee24
SHA3-384 hash: c953093bac0df8e5573366866ce781ef8ba8bed92bc49e17302e49151d31ec62de7b22dbe1346937d9ba9ffab93ea86d
SHA1 hash: 27c59e90159e70a5508d71165a304952fe10153a
MD5 hash: 4b3d3ede94e0f7890a11f7d41ea9a1f7
humanhash: twelve-apart-november-coffee
File name:Swift Copy.lha
Download: download sample
Signature AgentTesla
Create hunting rule
File size:34'582 bytes
First seen:2020-10-10 06:51:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:n/2sWFn6RFGwrnhGVeh/xDeeglDi09/8V1+vudTW0yH932z:n+s2nDwrYG/tUlO0GVaudK0yoz
TLSH 02F2F1DA0FC7819A40D2473DAEBC95918A0FAB9323C83D8722760F47D6C1D5D5F2A987
Reporter abuse_ch
Tags:AgentTesla Hostwinds lha


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-785563.hostwindsdns.com
Sending IP: 192.255.235.153
From: Liam Northover <lnorthover@alspec.com.au>
Reply-To: lnorthover.alspec.au@gmail.com
Subject: Re: Payment Swift Copy
Attachment: Swift Copy.lha (contains "Swift Copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74887b9b272ae5164770280337d67c87a3580c2988737dc72d5b0a219f2fee24/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 23:25:22 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=osehxgzhflsrmr3qfabtpvt4q6rvqdbjrbzx3rznlmfcdhzp5ysa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/74887b9b272ae5164770280337d67c87a3580c2988737dc72d5b0a219f2fee24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 74887b9b272ae5164770280337d67c87a3580c2988737dc72d5b0a219f2fee24

(this sample)

AgentTesla

Executable exe b38d650ba9f5c3d4010a044ef0a779cdaf63a65c38d29ca0ec934eba459d914a

  
Dropping
MD5 3b002ee01e915cca7d4f61cec2e3e3d8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b38d650ba9f5c3d4010a044ef0a779cdaf63a65c38d29ca0ec934eba459d914a

Comments