MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f203edc9a06c3f175b70798728ac7224ba96363805427ffc86f2317443a9d695. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f203edc9a06c3f175b70798728ac7224ba96363805427ffc86f2317443a9d695
SHA3-384 hash: a909e7d7d654a9596478812668fea3eb4e0f43b94d69def6971429d9ef282b50a3639af29e079b5a39790b28b02da115
SHA1 hash: 7a3fd198d42b02200dc12f80b4934d173fde10a0
MD5 hash: 97c5494dbdfab219c125e425d34e864d
humanhash: delaware-april-undress-neptune
File name:Payment Proof SWIFT 042619.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:432'900 bytes
First seen:2020-08-06 05:49:36 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:brCE8++wh0eQwNTjPRichlMaVpvehXKuAOOYm1TwGK4VpxMrHHm70ia+7BGKYWqf:nJ7NRiwMsehUMGJy5+7BGKZFh4h
TLSH A2942348D7213AB07D91391560E4B39E9F54B773F9E838D624ACD830D89E1F6B6248F2
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blinux.thesecurededicatedserver.com
Sending IP: 198.52.104.94
From: Sevinj Askerova <svaskerova@mst-az.com>
Subject: Payment Proof # SWIFT 042619
Attachment: Payment Proof SWIFT 042619.xz (contains "Payment Proof # SWIFT 042619.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f203edc9a06c3f175b70798728ac7224ba96363805427ffc86f2317443a9d695/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:51:09 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ib63snanq7row3qpgdsrldses5jmnryavbh77eg6iyxiq5j22kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f203edc9a06c3f175b70798728ac7224ba96363805427ffc86f2317443a9d695

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz f203edc9a06c3f175b70798728ac7224ba96363805427ffc86f2317443a9d695

(this sample)

AgentTesla

Executable exe 25b54e1822e3aa47ef8a94b6e326dda299d42081681d03eb514fa661a005d1db

  
Dropping
MD5 255c7fd7ea7cff6130db1bda7ee27116
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 25b54e1822e3aa47ef8a94b6e326dda299d42081681d03eb514fa661a005d1db

Comments