MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94f9c7747cd3afd58a81b104d4610984941e1714741751d5ded14fb6cea60e61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94f9c7747cd3afd58a81b104d4610984941e1714741751d5ded14fb6cea60e61
SHA3-384 hash: 26317ab8b79e226c9de5aee085cc1f00a074f8e3a5bc9d55489c1c65052d1387155029b6b4293a249d3452aa12746ec4
SHA1 hash: adb26e5c9b0a0eaad854bc779f920a888fc6a8aa
MD5 hash: a5ecba3fa10aa8fc47bf2ae660133443
humanhash: asparagus-massachusetts-jupiter-washington
File name:SWIFT COPY 2.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:295'336 bytes
First seen:2020-10-02 08:56:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:QYTIo1J181ZDWH0CWljJZ/f6+613KSV65IHkK6uHNOMehfI5Kl:QYTDuL403ljT/fK3dVBysEXhP
TLSH 925423BC4B1126DAA8CB7F106CC0FBC053BF9AE8F1599040695C1B29792ACD5FD5E136
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jandragon.com
Sending IP: 103.99.1.146
From: Jessica<cs01@jandragon.com>
Subject: RE: RE: PAYMENT DETAILS {URGENT REPLY!}
Attachment: SWIFT COPY 2.zip (contains "SWIFT COPY (2).exe")

AgentTesla SMTP exfil server:
mail.framafilms.com:87

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.276.4524.18742.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94f9c7747cd3afd58a81b104d4610984941e1714741751d5ded14fb6cea60e61/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 08:58:07 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=st44o5d42ox5lcubwecniyijqskb4fyuoqlvdvo62fh3ntvgbzqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94f9c7747cd3afd58a81b104d4610984941e1714741751d5ded14fb6cea60e61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 94f9c7747cd3afd58a81b104d4610984941e1714741751d5ded14fb6cea60e61

(this sample)

AgentTesla

Executable exe 535341ccd7f05015229ea15f24fa23baa11cc7596f7c79962564c6ed69fa4c64

  
Dropping
MD5 0e3d45cf9f4190f7eaca490da40c9bac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 535341ccd7f05015229ea15f24fa23baa11cc7596f7c79962564c6ed69fa4c64

Comments