MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a23ce45d4cfc2058c9231b8864b0dbd61320cc25a9d6d4b9b060652cf954aa22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a23ce45d4cfc2058c9231b8864b0dbd61320cc25a9d6d4b9b060652cf954aa22
SHA3-384 hash: 15d2df6578c1f8273a4da75e9957a7608b22d3cd1ff58f126bf73cd2dff151c39155cefd5912083fdb440fe544d19803
SHA1 hash: f6bbf31b513b8c9a6f9f5cf40cbd7b76a2c826bf
MD5 hash: b413103a9666ee385bfc715a1341dc03
humanhash: violet-nuts-six-romeo
File name:Payment Swift Copy.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'094'629 bytes
First seen:2020-07-03 08:30:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FbUGmJpl1CSz6Pfu/6GB4t+swirkI6YnLkk5Lq/qpa8jWW9AeM0o:FbUGApLC5PG6cXTfI6YnLkkJq/qpa8ja
TLSH 663533C39E6DB4AB9C8F806836913856D7306653BE20CAA0033E2697E4DF7DDDF54215
Reporter abuse_ch
Tags:AgentTesla lzh Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic311-52.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.188.233
From: manal <manula_salama@yahoo.com>
Reply-To: manal <manula_salama@yahoo.com>
Subject: Fw: Payment Swift copy
Attachment: Payment Swift Copy.lzh (contains "Payment Swift Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a23ce45d4cfc2058c9231b8864b0dbd61320cc25a9d6d4b9b060652cf954aa22/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 08:32:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ui6oixkm7qqfrsjddoegjmg32yjsbtbfvhlnjonqmbssz6kuvira._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a23ce45d4cfc2058c9231b8864b0dbd61320cc25a9d6d4b9b060652cf954aa22

(this sample)

AgentTesla

Executable exe 69aefba0bddbb8f38a5913d51d61936647e4dfccd4d561f51519f5a35d7f834c

  
Dropping
MD5 6af7ceb1d66148dc6925ffc77c43f752
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69aefba0bddbb8f38a5913d51d61936647e4dfccd4d561f51519f5a35d7f834c

Comments