MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06ca0c406827e20f81952c8ad12b4eaf42d6a36fe458c5a94e9156c3a9141ad6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06ca0c406827e20f81952c8ad12b4eaf42d6a36fe458c5a94e9156c3a9141ad6
SHA3-384 hash: 2f332469e7313f585ba93f3b67ca0927b31c60255bc95dfd653bd2e6c63d6c054ab681446fd3b481b9a5cfced3f2e134
SHA1 hash: 81670b196f368652b7230800f48c44d5f65384f6
MD5 hash: 5770281cb4b51c63e559c1c848755076
humanhash: carpet-oven-mexico-eight
File name:SWIFT CONFIRMATION.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:444'386 bytes
First seen:2020-09-20 20:14:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:SDDGzq0VodvFvhh/GflNpJXQPRPut2Yj6ldAw:O6FV2vFvv/MlNQkDj5w
TLSH 83942390A78CB9DEC579B07DAAA948CF01709E5D225F63601149FACDCD890B247E34BA
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "lueCrystal Trading LLC <Judy@longdogranch.com>"
Received: "from longdogranch.com (unknown [103.151.124.245]) "
Date: "20 Sep 2020 11:05:31 -0700"
Subject: "Re: SWIFT CONFIRMATION"
Attachment: "SWIFT CONFIRMATION.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06ca0c406827e20f81952c8ad12b4eaf42d6a36fe458c5a94e9156c3a9141ad6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-20 14:08:08 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3fayqdie7ra7amvfsfnck2ov5bnni3p4rmmlkkosflmhkiudlla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/06ca0c406827e20f81952c8ad12b4eaf42d6a36fe458c5a94e9156c3a9141ad6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 06ca0c406827e20f81952c8ad12b4eaf42d6a36fe458c5a94e9156c3a9141ad6

(this sample)

AgentTesla

Executable exe dc9ace93c1de0591c5e653c9e057fb2819bc0a832219adc2994097aae3906236

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc9ace93c1de0591c5e653c9e057fb2819bc0a832219adc2994097aae3906236
  
Dropping
AgentTesla

Comments