MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6fbf4a97a245bdaa48ee6f34f9cc30fcc4eaf73e974a993071ec2d7bcd1b7f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6fbf4a97a245bdaa48ee6f34f9cc30fcc4eaf73e974a993071ec2d7bcd1b7f8
SHA3-384 hash: 92cb24c01ec100c84c6b8b2de01f596526ca2f299996b5af888d7b6474ad63221a8fe010b003ef3e385e61fba9f72014
SHA1 hash: 3bd94dd6cd50aa2e34ef3c30ba8dc1d171f7e1ee
MD5 hash: 37bcc9da54c9b6e81c5ecf396a7dc207
humanhash: south-cardinal-wolfram-cup
File name:SWIFT_0001~PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'900'544 bytes
First seen:2020-06-18 06:15:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:DUBcxqhffV2vgG0c8+Wu3tvGAtNpJs3IYXzkyrxXxgsAf/1xnr:D+n3IvgleWu3tvG8sYYd4sAf
TLSH A595E062F2907833C152157E5C0B977C9926BE512A2866873FFD6D4CAF3D282392B1C7
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.dysonservicecentre.uk
Sending IP: 142.11.210.43
From: Accounting Team <wjted@dysonservicecentre.uk>
Subject: Re: Invoice_MO2058295V & M000472548D T/T Swift Copy Confirmation
Attachment: SWIFT_0001~PDF.IMG (contains "Swift Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Herz.B.1841.13606.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 02:51:07 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w357jkl2ern5vjeo43zu7hgdb7ge5l3t5f2kteyhd3bnppgrw74a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img b6fbf4a97a245bdaa48ee6f34f9cc30fcc4eaf73e974a993071ec2d7bcd1b7f8

(this sample)

AgentTesla

Executable exe fa482d8c31df688e69dd251c1ced2c142961cb1bb42e65f2344b356fc94f0336

  
Dropping
MD5 202b5f25f00160ecc1f1f19dd69e7f52
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa482d8c31df688e69dd251c1ced2c142961cb1bb42e65f2344b356fc94f0336

Comments