MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed1204fc51b89bc7514c06f71b3ccd25bbb528f0e643f462cb181eddfee2c924. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed1204fc51b89bc7514c06f71b3ccd25bbb528f0e643f462cb181eddfee2c924
SHA3-384 hash: 2f825462de100d6a49e64eae0b571df321898410ad0c95db15d0bbb2cee9c5129ae6ec6df72973ee53103f9efb1a77dc
SHA1 hash: b5dffa40c2665541a96d3b6a0f66f45e5c079edb
MD5 hash: 66d58da7fa4294113f335852453c7a3a
humanhash: potato-cat-uncle-triple
File name:Swift209832.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'147 bytes
First seen:2020-11-26 07:08:39 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:WX3h5+GoC3avF8J5mNAgj+10C1Uym2wrh0Up0ez+iEkn8UR:W3+GoCqvF8K+1DZ6r90e5v8UR
TLSH C89423415498E3134D8CE64A72CDB0E26A91B3BDCB4C36B6C625EBC3DDB64BC1386527
Reporter cocaman
Tags:AgentTesla gz SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: ""Maulik H. Shah" <rcldxb@rclgroup.com>" (likely spoofed)
Received: "from mail.apartacel.com (apartacel.com [200.52.172.106]) "
Date: "Thu, 26 Nov 2020 04:35:19 +0100"
Subject: "RE: Payment Confirmation"
Attachment: "Swift209832.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed1204fc51b89bc7514c06f71b3ccd25bbb528f0e643f462cb181eddfee2c924/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ujaj7crxcn4oukma33rwpgnew53kkhq4zb7iywldapn37xczesa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ed1204fc51b89bc7514c06f71b3ccd25bbb528f0e643f462cb181eddfee2c924

(this sample)

AgentTesla

Executable exe 045b92b336103f95c9a5acff35461d8eb69bbf9aaed8158787362e2853a50e4c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 045b92b336103f95c9a5acff35461d8eb69bbf9aaed8158787362e2853a50e4c
  
Dropping
AgentTesla

Comments