MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0922db232128a59f3971d7f439251be08ea84c5f6760ca4b752fe8d336896304. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0922db232128a59f3971d7f439251be08ea84c5f6760ca4b752fe8d336896304
SHA3-384 hash: bae040e4ac082ff8abc4a69281117594becf98ab77f40fffac2bff8b84f663bd22613991588eb9b19903517a2e3e145b
SHA1 hash: 4c5de7a1978f6b115c600ada13d8645fbef2ebaa
MD5 hash: 0dadd402dc40df9a869f8acc3690c7ff
humanhash: timing-mirror-princess-river
File name:SWIFT TRANSFER.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:963'419 bytes
First seen:2020-10-20 08:51:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:B4QJugxaDHxFmiKBhUdF+0cZtaznMSqRiBfXhxVQXA06NA:BZJIHggdF+zaz6Rgf1D06NA
TLSH 7A2533B91F47FAEC1A90D610CAE849158F613176CA9CD9AE3E2072701EE16F3037697D
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: meggle-ame.com
Sending IP: 193.169.253.158
From: ACC. MANAGER <salescoordnator@meggle-ame.com>
Subject: AUTHORISED SWIFT TRANSFER
Attachment: SWIFT TRANSFER.Z (contains "SWIFT TRANSFER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21948.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0922db232128a59f3971d7f439251be08ea84c5f6760ca4b752fe8d336896304/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Suspicious
First seen:
2020-10-20 00:20:14 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bernwizbfcsz6olr272dsji34chkqtc7m5qmus3vf7ungnujmmca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/0922db232128a59f3971d7f439251be08ea84c5f6760ca4b752fe8d336896304

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0922db232128a59f3971d7f439251be08ea84c5f6760ca4b752fe8d336896304

(this sample)

AgentTesla

Executable exe 8e7e676c27370f678c6ff73f5d6f508e197a0448f33f25f4f8f48f35d64df0ea

  
Dropping
MD5 3d515b4129aee68ad7ecc4017f08475d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e7e676c27370f678c6ff73f5d6f508e197a0448f33f25f4f8f48f35d64df0ea

Comments