MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86c709fb8e0173e4d3cf214cdf6bc7aa39381deaefef061d6ced65d8883fac0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86c709fb8e0173e4d3cf214cdf6bc7aa39381deaefef061d6ced65d8883fac0a
SHA3-384 hash: 438092aadb02818a1eeff8d14b4d2797ca1ceb3a5a2405fc4870799f613a9e8747c845b736fbec706329b5e1db724cd9
SHA1 hash: f5438fae0039e50eb2c9ad9f75ab8c64dee180be
MD5 hash: 36b1b795f075c60fc617edc8a6348896
humanhash: papa-oscar-victor-crazy
File name:Swift Copy For Payment,Thanks.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:486'006 bytes
First seen:2020-07-06 15:05:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:L0g9VOm2YfccSH0eN6Qogrj961J2BttAzlWVJJHESgSs:TOTY0cSH0M6Aj94J2BjZ/fs
TLSH 50A4231292F37C34CB1966F054B5ABC021FF9FFA599523C98DC5E8CDA027499C29E315
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "Sanjnna.S"<purchase1@perfectsales.in>
Reply-To: bquinnlin@gmail.com
Subject: Swift Copy For Import Bill Deposit,Sorry for any inconvenience,thanks.
Attachment: Swift Copy For Payment,Thanks.zip (contains "Swift Copy For Payment,Thanks.exe")

AgentTesla SMTP exfil server:
smtp.na-superhrd.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Daqc-6598201-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86c709fb8e0173e4d3cf214cdf6bc7aa39381deaefef061d6ced65d8883fac0a/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 15:07:04 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3dqt64oafz6ju6pefgn626hvi4tqhpk57xqmhlm5vs5rcb7vqfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 86c709fb8e0173e4d3cf214cdf6bc7aa39381deaefef061d6ced65d8883fac0a

(this sample)

AgentTesla

Executable exe e640fad06c4f66298aaa5e4a4beb4a210131f6799ed82a69e5db5da21ec53d7c

  
Dropping
MD5 f9ce4bb5bd6195acdf6be46d814ce47d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e640fad06c4f66298aaa5e4a4beb4a210131f6799ed82a69e5db5da21ec53d7c

Comments