MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2538dcc5dfa705987b5f9ad7c83cff3512ac96dea2c575108df3d65dc816b2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2538dcc5dfa705987b5f9ad7c83cff3512ac96dea2c575108df3d65dc816b2f
SHA3-384 hash: 97c81d905853a8c082162bbb7850dd9dcaa23c5686592816b61bf1fb92eae927e69c8d39a40be71ce41dc5c4858572a8
SHA1 hash: 9d75d5fdeeb3fad427951ceb3467d2a0ef4bd66f
MD5 hash: 384c56b02c20131fabfd6cf1d81ccd28
humanhash: emma-orange-carbon-music
File name:Bank SWIFT Advice_pdf.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:517'498 bytes
First seen:2020-11-19 06:40:48 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:blbxMNRu0dRTnUs6rFAcV5laNM2QVc7PCqP8:bfMbLbgs6rLl05Ec7PCq0
TLSH 78B4238BB19652DC095E4BC5F18ECBDBE3DF960C0783952B9A4B7174BC0A9912BC2487
Reporter abuse_ch
Tags:AgentTesla Citibank xz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: noy0.demin-logistics.com
Sending IP: 194.87.138.221
From: CitiBank. <payable@citibank.com>
Subject: Bank Swift Advice_ 18-11-2020
Attachment: Bank SWIFT Advice_pdf.xz (contains "Bank SWIFT Advice_pdf.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2538dcc5dfa705987b5f9ad7c83cff3512ac96dea2c575108df3d65dc816b2f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ujjy3tc57jyftb5v7gwxza6p6nisvsln5iwfouii346wlxebnmxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz a2538dcc5dfa705987b5f9ad7c83cff3512ac96dea2c575108df3d65dc816b2f

(this sample)

AgentTesla

Executable exe 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178

  
Dropping
MD5 f125be2430fa6fa2160adfcf0f148af3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178

Comments