MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de4b7bfcf79f3b21d5a62f74fc48ea893089e9545f403d45fb0677de1209dbf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de4b7bfcf79f3b21d5a62f74fc48ea893089e9545f403d45fb0677de1209dbf8
SHA3-384 hash: 3b2f0635d244cede03ff077855ec3f8a9f31b08d0520244db03d05453b82cec288af220ab7b37d072b1b4f0b28bed201
SHA1 hash: 71fad103822b027151c97dc99dd9077763ee98b6
MD5 hash: 548aa7b218f62b593e4f160fb7b0fe07
humanhash: hydrogen-zulu-india-juliet
File name:Transfer_EXP-008-MAY-20.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:511'233 bytes
First seen:2020-06-15 12:05:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:03JhsmtYHRxCQMtr6ijNAjrd3Ugr35XD+moi8eDsgRSv/urf:Kt0cftbkxj35T+moCsDurf
TLSH 4BB42380B0B1D705399E941CAE055FB2AB90524EDFB4746C7DB79BF93C7890A0871F8A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ej-email.beyaz.net
Sending IP: 207.154.196.223
From: Giorgio Arrosti <ihsan.gokcek@12m.com.tr>
Reply-To: giorgioarrosti@yahoo.com
Subject: SWIFT MT103
Attachment: Transfer_EXP-008-MAY-20.zip (contains "Transfer_EXP-008-MAY-20.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:07:04 UTC
AV detection:
36 of 47 (76.60%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3zfxx7hxt45sdvngf52pyshkreyit2kul5ad2rp3az354eqj3p4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip de4b7bfcf79f3b21d5a62f74fc48ea893089e9545f403d45fb0677de1209dbf8

(this sample)

AgentTesla

Executable exe 9426eff06a9e6de76b0168a39d457eebc368318ba1c468c8e6b04fe6f7b64b04

  
Dropping
MD5 1d4b54a8ef94e91d39f6db041bb05f4e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9426eff06a9e6de76b0168a39d457eebc368318ba1c468c8e6b04fe6f7b64b04

Comments