MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de89038a3b6101c71b7a51be6874e00caa10bd0492d89605fc24e659e3e514f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de89038a3b6101c71b7a51be6874e00caa10bd0492d89605fc24e659e3e514f9
SHA3-384 hash: b0e2d6183affc6e6a01dc2557633fc33804ecf3753582701c8f56aff87ed67a1612b885db6a954422771bab89a8c5974
SHA1 hash: d29ef242d7d17d8fa407cd7f36e363687044b5f4
MD5 hash: e6fecda36c789e86f44b9101f1af6462
humanhash: fanta-low-ten-mirror
File name:Swift Forms.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:704'566 bytes
First seen:2020-08-28 06:41:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GZFhHQsKMIegD5X1UrqU7ncSLxSBC2XbxoZl24wy+myGyrAoC:GpHQsKHegD5XgYSLEBvX9gl2ubyrAoC
TLSH 79E4334E08C55577CFE3E08B2F3AC3449DA55E65AF15EAB43E6032DDA76A60A1D00C3E
Reporter abuse_ch
Tags:AgentTesla Endurance rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: PAY-U INT'L <enquiry@oxy99.in>
Subject: INCORRECT BANK DETAILS FOR PAYMENT
Attachment: Swift Forms.rar (contains "Swift Forms.pdf")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de89038a3b6101c71b7a51be6874e00caa10bd0492d89605fc24e659e3e514f9/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 04:41:09 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32eqhcr3mea4og32kg7gq5habsvbbpieslmjmbp4ettfty7fct4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/de89038a3b6101c71b7a51be6874e00caa10bd0492d89605fc24e659e3e514f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar de89038a3b6101c71b7a51be6874e00caa10bd0492d89605fc24e659e3e514f9

(this sample)

AgentTesla

Executable exe 832962d7bc1997a05b9ace55a18092ae7fb97cd3e75bcb30946a31e4f0bc5feb

  
Dropping
MD5 62dfb7e19a35ec596d9fd64c8664ced3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 832962d7bc1997a05b9ace55a18092ae7fb97cd3e75bcb30946a31e4f0bc5feb

Comments