MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5bc67d193ca8df357de0f44810d74dbfee8bec8a231ed12115b909ce69ee4aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5bc67d193ca8df357de0f44810d74dbfee8bec8a231ed12115b909ce69ee4aa
SHA3-384 hash: 395e1bfabd2433fafa4901a415b8525bb40e20cabceeb2bc9d2de5a64a669d4abb1aebacf6fdd922d2e5631a3ad7cc76
SHA1 hash: 132e6644894d1160e12dbcc99baa08048ff557df
MD5 hash: 0b31759467a2ae4f0a3a9fcc458bb2b7
humanhash: mexico-triple-aspen-kentucky
File name:SWIFT 001.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'837 bytes
First seen:2020-06-03 13:35:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:b9L/dWqO80JIoGjkGHMt7q4AI23N819CJqQ:ZX0A0qZI2WHC1
TLSH F394230ADDA5FF12A46852931F932CEB73E6EE10AD170F573B86055EC8F5BD230A1216
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.livemail.co.uk
Sending IP: 213.171.216.60
From: Junie Yong <miqbal@jksugarmills.com>
Reply-To: miqbal@jksuqarmills.com
Subject: RE: USD AMOUNT : 60000/= SWIFT MESSAGE - Remittance date 3RD JUNE 2020 -Swift enclosed for your Reference (Ref Q3 2019 Order)
Attachment: SWIFT 001.rar (contains "SWIFT 001.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 14:35:52 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uw6gpumtzkg7gv66b5cicdlu3p7orpwiuiy62eqrloijzzu64sva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a5bc67d193ca8df357de0f44810d74dbfee8bec8a231ed12115b909ce69ee4aa

(this sample)

AgentTesla

Executable exe dab4d45b3d041bec38bb40ef34ec38a6efee4c8e582c9032f22d5bca9115c189

  
Dropping
MD5 6b815099f64605ef6916e1d7bf149893
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dab4d45b3d041bec38bb40ef34ec38a6efee4c8e582c9032f22d5bca9115c189

Comments