MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60f3cbc6715fc348564d4a4a2cef3f2958e892ac4072792b8d266d8aeea6fe88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60f3cbc6715fc348564d4a4a2cef3f2958e892ac4072792b8d266d8aeea6fe88
SHA3-384 hash: fb0464b5fc695ec10e2ce376378eb9c8bfd76f67e4b3e4d2adf5e3f1c2466ae2afce2aca1204385d707e9ae46deb5dad
SHA1 hash: 2ccf0e65ed23fc54fc0b7e63ec70525072b324b1
MD5 hash: 0a3c1c40a9d33a79a8d395abae231750
humanhash: eight-solar-video-king
File name:SWift Copy113X.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:548'672 bytes
First seen:2020-10-26 14:52:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:yC4dsvh0yxa9qdrZR5edVLAUDTg24QDrJ0gjOk3Q6mVIvAyLieTTMSSL3+83j4B0:+47FZ7edVLAjkkIvbieKnKI4TlXtBQ
TLSH EEC42360A3F8B897B55AA04450137CFB6EFBC481C74EC0443386E6A5DE06EB5F61BE52
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: woori.com.vn
Sending IP: 199.96.83.29
From: Woori Bank Vietnam <tbd@woori.com.vn>
Reply-To: jp.intl111@gmail.com
Subject: Payment Advice from Woori Bank
Attachment: SWift Copy113X.rar (contains "SWift Copy113X.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60f3cbc6715fc348564d4a4a2cef3f2958e892ac4072792b8d266d8aeea6fe88/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 08:28:32 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdz4xrtrl7buqvsnjjfcz3z7ffmorevmibzhsk4nezwyv3vg72ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 60f3cbc6715fc348564d4a4a2cef3f2958e892ac4072792b8d266d8aeea6fe88

(this sample)

AgentTesla

Executable exe 1295fb62e8f0296d96813f9584e50ba594c2cbcfc0f4f86c0428e3a9ed765e65

  
Dropping
MD5 3b6dd337e9bb13e2c3f1a301f88a2d2e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1295fb62e8f0296d96813f9584e50ba594c2cbcfc0f4f86c0428e3a9ed765e65

Comments