MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86f16916ada3acf3c3558efeb3cfd58c49a95ab1e07ad01a923b3e56dd5a8a84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86f16916ada3acf3c3558efeb3cfd58c49a95ab1e07ad01a923b3e56dd5a8a84
SHA3-384 hash: 2b813d45b24c7b866867c0be52f8c03cecf4b82ffd9cb2288788118e7fb77a67757325fc0a3b2cac7977e53ad0173958
SHA1 hash: 83964fc414c868358a6f46ebfe8630c8804c4853
MD5 hash: a0e3a9dfbcdfa9a02a0167ac100403a3
humanhash: happy-seventeen-hawaii-fix
File name:USD SWIFT _679388 TT 190617_2019-NLCIV000003576_ES146009_30309679.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'259 bytes
First seen:2020-06-15 13:12:07 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:7lYL6/JbRGZ5FEkqtSHzuEsqW8AKSHgO9JNeEAyQbtZ+4uwONG+Kqmwevxc2J:7+ZL2qzuJ8kAkxmL+4upNrKq6cK
TLSH 719423F417BB5E457ADD45528223EA44CB25CFA6237396F719C2071F08E68C5C3A29C7
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lasfragancias.com
Sending IP: 200.110.77.218
From: vakifleasing <valvarez@lasfragancias.com>
Subject: AW: Swift
Attachment: USD SWIFT _679388 TT 190617_2019-NLCIV000003576_ES146009_30309679.z (contains "USD SWIFT _679388 TT 190617_2019-NLCIV000003576_ES146009_30309679.exe")

AgentTesla FTP exfil server:
ftp.connectus-trade.net:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:14:04 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3ywsfvnuowphq2vr37lht6vrre2swvr4b5nagushm7fnxk2rkca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 86f16916ada3acf3c3558efeb3cfd58c49a95ab1e07ad01a923b3e56dd5a8a84

(this sample)

AgentTesla

Executable exe b3dfc9fb1c0e38b8f1efb13d7ecf1e1d118ba2d9f465c246861eeb3f943e8626

  
Dropping
MD5 5774b6feacc679debb8a1e1a203a3724
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3dfc9fb1c0e38b8f1efb13d7ecf1e1d118ba2d9f465c246861eeb3f943e8626

Comments