MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74f0fb806376143ac19f5d1f11a9e836a7cb6cc5e6a7e0e15545e2652dc6a616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74f0fb806376143ac19f5d1f11a9e836a7cb6cc5e6a7e0e15545e2652dc6a616
SHA3-384 hash: ce3c57b5492f24c2734811772d8986a662084de09974d382fc308bdfaca599e948b694a8151b78a90ce0d581e9a20cec
SHA1 hash: 6c1a7b11109bf84892bbe8ace06e360d566fab8a
MD5 hash: 441c2c28be3e7edd14b9a9dae3971778
humanhash: shade-lion-maryland-social
File name:swift.UUE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'351 bytes
First seen:2021-10-06 06:40:19 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 6144:bMW65N4ON2Il8G17bs2ys+06exdYTyq6pgcdi7ZF1Ch1kpbF5TD677lmzwGMJgJl:bRu4E2wz1v/gcCNCh1ybrc7cnMSl
TLSH T1A69423569702866C990AF846DF1C1D8D840D89473D970EECE9926DEC8DAB3F38199F3C
Reporter cocaman
Tags:SWIFT uue


Avatar
cocaman
Malicious email (T1566.001)
From: ""Sindhuja Thiyagaraja" <sindhu@asokaglass.lk>" (likely spoofed)
Received: "from asokaglass.lk (unknown [185.222.57.88]) "
Date: "05 Oct 2021 12:47:30 +0200"
Subject: "SWIFT COPY - USD 67149.01 - Brokerage Bill - Agri Global Commodity DMMC"
Attachment: "swift.UUE"

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615d4508e3d213d202b8360a/reports/4f4023df-03c1-41f3-b8af-ad3a8a4c1e82/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74f0fb806376143ac19f5d1f11a9e836a7cb6cc5e6a7e0e15545e2652dc6a616/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 07:06:43 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=otypxaddoykdvqm7luprdkpig2t4w3gf42t6bykvixrgkloguyla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74f0fb806376143ac19f5d1f11a9e836a7cb6cc5e6a7e0e15545e2652dc6a616

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 74f0fb806376143ac19f5d1f11a9e836a7cb6cc5e6a7e0e15545e2652dc6a616

(this sample)

AgentTesla

Executable exe 8221c75dedf785b6bb837603c18951e9ff630975d13af04a9b5791e429d554e8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8221c75dedf785b6bb837603c18951e9ff630975d13af04a9b5791e429d554e8

Comments