MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0eed12f0dcf05f910bfe683b838cd62fcfe68bdee03d708b63ab84249a95937f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0eed12f0dcf05f910bfe683b838cd62fcfe68bdee03d708b63ab84249a95937f
SHA3-384 hash: 2255286863c593b52cc56f05158692a816d782e393cf74bee83ccd79a503793c5a34e27e813e684c33ce542fdf79d2fe
SHA1 hash: 277a84f696034e01ce1797f8acd537db9b9c351b
MD5 hash: 2b24821fa20533358eb3d0b763c82755
humanhash: twenty-friend-harry-minnesota
File name:swift_copy2020710_XLS.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:378'616 bytes
First seen:2020-07-10 07:33:25 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:vcGDlChM/08gstI0H1wHJpmZHjHD+7bPlvf5DzXYloQnOIFXwtAxbWLhgF5klq8v:0GD4hMc8gJswpmFLqHdn5D0OQnOWstyK
TLSH 658423BD331AD3EBF9A9DD2CB1085BBD1950B8C81FC79EAB433502475055A9428C1FEA
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jabba.chaiyohosting.com
Sending IP: 61.47.2.164
From: DO_NOT_REPLY_0409@pilotservices.co.th
Subject: payment copy
Attachment: swift_copy2020710_XLS.z (contains "swift_copy2020710_XLS.scr")

AgentTesla SMTP exfil server:
server266.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0eed12f0dcf05f910bfe683b838cd62fcfe68bdee03d708b63ab84249a95937f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 07:35:04 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3wrf4g46bpzcc76na5yhdgwf7h6nc664a6xbc3dvoccjguvsn7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 0eed12f0dcf05f910bfe683b838cd62fcfe68bdee03d708b63ab84249a95937f

(this sample)

AgentTesla

Executable exe 4014ffe3401353775e6629a83400a9b34768c6127eff3d4b12b042290c9ed80d

  
Dropping
MD5 ccbd8c021b03a2815dc6cd096e353149
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4014ffe3401353775e6629a83400a9b34768c6127eff3d4b12b042290c9ed80d

Comments