MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b810db841f4449d0c765f5b6c614ba3092ced994af464a6560ddd2b402444349. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b810db841f4449d0c765f5b6c614ba3092ced994af464a6560ddd2b402444349
SHA3-384 hash: bf7f7d7aa6aeba1c0baa79be48d018908b640afc14b631bc4c5e4789a2324cafc2f9aed4980d15f69b68f3f7721021ab
SHA1 hash: 7f4ef59ed4b07ef8f7763bc59e054bbdfb428416
MD5 hash: fb279dd531e48e5868187c8d62350408
humanhash: double-river-sweet-nebraska
File name:USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:380'035 bytes
First seen:2020-07-12 08:12:01 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:lRk2oplJuXam0wK2x1xtw3ECyHWrnGx3mw8j4c4C0g1fwDdw1drL4/SJTsup:TkDp6XNZLTYO2rnu2wc7vN1idw1drLEo
TLSH B284234974D726C283D83A62803DB3637B916D038B91728DDEE31E6D37956C0B684EBD
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lasfragancias.com
Sending IP: 200.110.77.218
From: R2_SSC Russian <asistenteconsul@lasfragancias.com>
Subject: AW: Swift
Attachment: USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.z (contains "USD TT SWIFT _679388 190617_2019-NLCIV000003576_ES146009_30309679.exe")

AgentTesla FTP exfil server:
ftp.rebu.co.rw:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b810db841f4449d0c765f5b6c614ba3092ced994af464a6560ddd2b402444349/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-12 08:13:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xainxba7ire5br3f6w3mmff2gcjm5wmuv5deuzla3xjliaseineq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z b810db841f4449d0c765f5b6c614ba3092ced994af464a6560ddd2b402444349

(this sample)

AgentTesla

Executable exe aed428639ef8418476a13687beed0c54fd48a8d89ca0d9a669439b31d93ca779

  
Dropping
MD5 c62ae892f460e763bb27fefeb4299f73
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aed428639ef8418476a13687beed0c54fd48a8d89ca0d9a669439b31d93ca779

Comments