MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9afcd49b3f4b5d811e959af1b8be657507834fb2349e14422bf8d88620bf81d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: a9afcd49b3f4b5d811e959af1b8be657507834fb2349e14422bf8d88620bf81d
SHA1 hash: 5fd242ec756bd56adee68b919e83963b4c4c8030
MD5 hash: 9bc67d44f58c66390dac507c07786f18
File name:SWIFT.exe
Download: download sample
Signature AgentTesla
File size:740'864 bytes
First seen:2020-05-23 11:18:57 UTC
Last seen:2020-05-23 11:46:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29d9aa9d7ab02ca63c870eb08d549a22
ssdeep 12288:CsybHd/zvDue757IRUPCYm+eQcFlxypu82quAnxGyRMJGs1QxYg+Ix:X2xzvv7IRUP/eRFyp2qXnyJGxYg++
TLSH 1DF4AF22F2E14437DDA31A7D4C3BDF78582EBE51392869461BE45D4CAF38781382629F
Reporter @abuse_ch
Tags:AgentTesla exe

Malspam distributing AgentTesla:

From: "mBank S.A." <>
Subject: mBank S.A. - transaction confirmation
Attachment: SWIFT.rar (contains "SWIFT.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
IT Italy Low
Global Low
# of uploads 2
# of downloads 23
Origin country US US
ClamAV Sanesecurity.Rogue.0hr.20200522-2203.UNOFFICIAL
VirusTotal:Virustotal results 50.00%
ReversingLabs :No data

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe a9afcd49b3f4b5d811e959af1b8be657507834fb2349e14422bf8d88620bf81d

(this sample)

Delivery method
Distributed via e-mail attachment