MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a05bb55dafdf0bbd22ef7c800c877b21b00f70d3de2ee1d73c3a6e60066451e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a05bb55dafdf0bbd22ef7c800c877b21b00f70d3de2ee1d73c3a6e60066451e
SHA3-384 hash: f97a442e896348211325237c7934c7075af57c829b477b0338c399b9f7b088932066ac42b33f8de46c0cefaefca37eba
SHA1 hash: e0d04a1da027807f1c249e2379631b9b6383e92e
MD5 hash: 9f2bc124e9349ad95bcb2e45c607e88a
humanhash: victor-solar-sodium-sodium
File name:Swiftcopy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:688'213 bytes
First seen:2020-08-17 09:18:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:s/e9iOnN8RBtrch22fL3NX+JZnYw8LOK5XZ8jQPUIptAJag7aJkMf9pG6h9Q3e7Q:EmvN8nStT3F+JZn98LDXZ1UotmMfH79c
TLSH 3BE423091EF188DB1EF878B82823F6BDEB4A5D43596395034A92F1440D19939F9E9CCF
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: =?UTF-8?Q?Gregory_M=2E_Simmons=2C_CFP=E2=84=A2?=
<info@sanfrangroup.com>
Received: from cloudhost-76768.us-midwest-1.nxcli.net (cloudhost-76768.us-midwest-1.nxcli.net [209.126.25.17])
Date: Mon, 17 Aug 2020 01:56:44 -0700
Subject: Swift copy
Attachment: Swiftcopy.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21367.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a05bb55dafdf0bbd22ef7c800c877b21b00f70d3de2ee1d73c3a6e60066451e/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 09:20:06 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nic3wvo27xylxuro67eabsdxwinqb5ynhxro4hltyotomadgiupa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/6a05bb55dafdf0bbd22ef7c800c877b21b00f70d3de2ee1d73c3a6e60066451e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6a05bb55dafdf0bbd22ef7c800c877b21b00f70d3de2ee1d73c3a6e60066451e

(this sample)

AgentTesla

Executable exe 86339324135e2584d960711e0adad1563fe4d577ff72a5f0a715b8e1768ae69f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86339324135e2584d960711e0adad1563fe4d577ff72a5f0a715b8e1768ae69f
  
Dropping
AgentTesla

Comments