MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9fe4f49d216af9bc63e09a606736f09a4db6d84ea16e2b76399807be8734c17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9fe4f49d216af9bc63e09a606736f09a4db6d84ea16e2b76399807be8734c17
SHA3-384 hash: 7c691e5a1ffec9c0a26ed84d8881b747ab9bf9034d82a092242e30a9ca5368711a0c4f356bf44bc3a63d2c84e4a18388
SHA1 hash: 14ca252648af240a16592239147bc43167cad0d4
MD5 hash: 180f3154b3140c98d4d573f1401a54fe
humanhash: october-fillet-enemy-september
File name:Swift Copy-TRF-01224353_MT103.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:529'104 bytes
First seen:2020-10-19 06:41:41 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:PaQo5SjU+r/sI0kdITdT5QEZo4/Rdc91jU:iQD4BBxTiufI1A
TLSH DCB4238CFAB6AD991F92905E4AEC2F30F8233B4FB373CF4815E195245C815E69A6C4C5
Reporter abuse_ch
Tags:AgentTesla gz HSBC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.untrarto.com
Sending IP: 45.153.203.102
From: HSBC ACCOUNTS <office@untrarto.com>
Subject: Proforma Invoice Payment Notification (Swift Mt-103)
Attachment: Swift Copy-TRF-01224353_MT103.gz (contains "gunzipped")

AgentTesla FTP exfil server:
ftp.interprizecloude.com:21

AgentTesla FTP exfil user name:
hoh@interprizecloude.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.25904.25486.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9fe4f49d216af9bc63e09a606736f09a4db6d84ea16e2b76399807be8734c17/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 22:39:41 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vh7e6sosc2xzxrr6bgtam43pbgsnw3me5ilofn3dtgahx2dtjqlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9fe4f49d216af9bc63e09a606736f09a4db6d84ea16e2b76399807be8734c17

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a9fe4f49d216af9bc63e09a606736f09a4db6d84ea16e2b76399807be8734c17

(this sample)

AgentTesla

Executable exe b84aa5ba2bf1c040d2f318a7f5ff77ee7e8e98a33c458f32c737106568549879

  
Dropping
MD5 11d77ff29ee120e8ffea14b32bd2d5b7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b84aa5ba2bf1c040d2f318a7f5ff77ee7e8e98a33c458f32c737106568549879

Comments