MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd7ece44493f03f7aecd3796d02225a53deddad63b65de7f65d29048115c98ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd7ece44493f03f7aecd3796d02225a53deddad63b65de7f65d29048115c98ce
SHA3-384 hash: 59da3f094dbad7e2a919b1e1daba3ca0fe0ca47232e7ac07b63d3cf354d4a1fe7792d9bfde4b8013cd1b94ab735bea7b
SHA1 hash: ba3c411b7578bc6539e974688208696dec8dec0a
MD5 hash: 651fe067b21f077eee2f158c2ccd98a2
humanhash: papa-pizza-cat-lactose
File name:Swift Copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:892'752 bytes
First seen:2020-06-17 11:41:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:OcrKdB/GO+c/yR+VDW4xTo01U883rWIC6uTFpespN9T2+g6//68g9rPNBCGoK7W:drwJ+cfVLxc01UXtCVfPT2+Blg1nFa
TLSH 521533301AEE26BB6F3537CFC1168AD94B053FDA31E9B1969F11C2689D310EC394D9A4
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.160
From: William Ko <opr6.ae@absaco.com>
Subject: June Payment
Attachment: Swift Copy.rar (contains "Swift Copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 12:35:57 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3v7m4rcjh4b7plwng6lnairfuu663wwwhns5473f2kieqek4tdha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dd7ece44493f03f7aecd3796d02225a53deddad63b65de7f65d29048115c98ce

(this sample)

AgentTesla

Executable exe 1c5653f7880f54b86f76ab009eb9775f3596d89e836d3d9bdb3c921612cb845b

  
Dropping
MD5 60e4981cf8ab5329b2616f84757822f8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c5653f7880f54b86f76ab009eb9775f3596d89e836d3d9bdb3c921612cb845b

Comments