MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d20d604048cb4383d9fcfd6a09ec788b3b2f61793d59b2525ef5e4e9cbe77b34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d20d604048cb4383d9fcfd6a09ec788b3b2f61793d59b2525ef5e4e9cbe77b34
SHA3-384 hash: a804077f2e6598ad80d5c872c26af4c0fd6410beec5d4945c2315461bea2f86ae9c6f340fa1a8110b874469fa5fbb557
SHA1 hash: 439c823535b942b4050ba70b2b0921092dcd0b10
MD5 hash: b1e128a3494f0a3f303618f0904c5373
humanhash: romeo-one-mexico-sierra
File name:Scan copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'037 bytes
First seen:2020-06-03 07:38:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:jx/kjUSTDwO8jBMj1VjFk+cDTfsCzaRaaujTNRmSiK1FvpPaXDn78+rUrCUHV+:PSwO8FCTLIdzaavNRmBK1vPew+ITA
TLSH F994236FE6C62AE0D00525887DF5EF95248AB79DF038D4D7DA7B0CAF38842A75237250
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: digamma.host-in-europe.com
Sending IP: 62.75.189.83
From: kudinova@otis.kz
Subject: RE: USD AMOUNT : 60000/= SWIFT MESSAGE - Remittance date 3RD JUNE 2020 -Swift enclosed for your Reference (Ref Q3 2019 Order)
Attachment: Scan copy.rar (contains "Scan copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 08:02:48 UTC
File Type:
Binary (Archive)
Extracted files:
317
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2igwaqciznbyhwp47vvat3dyrm5s6ylzhvm3eus66xsots7hpm2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d20d604048cb4383d9fcfd6a09ec788b3b2f61793d59b2525ef5e4e9cbe77b34

(this sample)

AgentTesla

Executable exe a72f9a0317980cebc1acdc4f89b372a09004a4fc7537f80ab0eb52b2fc94746f

  
Dropping
MD5 1c84c0e6d7922b837e1f2c5ca160e706
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a72f9a0317980cebc1acdc4f89b372a09004a4fc7537f80ab0eb52b2fc94746f

Comments