MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6860bf2c187037363770ecc05ea33bfd181679a1ba982b1f7801737489e0cef0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6860bf2c187037363770ecc05ea33bfd181679a1ba982b1f7801737489e0cef0
SHA3-384 hash: 3e206dd5ea7e7daffcd5153c405f094f36250df41cdcb02d208bb705146a4c89f0adc0a588e355431672f00b17cd206a
SHA1 hash: 996f4f993c4ca945200f592523b098b9d90d8cc5
MD5 hash: 5e50ffe5c834e35f5034b84066a8bd4c
humanhash: west-friend-saturn-cold
File name:SWIFT.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:607'437 bytes
First seen:2020-09-01 07:26:54 UTC
Last seen:2020-09-01 14:10:35 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:SRNaG3OEJK8FZo3wTLDn3qdF6okZnIGEhrZRGvbo0l3:CwlsPT+B2nIGEhr+9l3
TLSH 12D4232DC12BAEFB4CE16D4976405B7814D929BC3817410EE4FFEA15C72A2FDB5A0782
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: Julie Ann Provido <julie@eucgate.com>
Received: from eucgate.com (unknown [209.58.149.99])
Date: 1 Sep 2020 11:39:46 -0700
Subject: SWIFT_ 31/08/2020
Attachment: SWIFT.zip

Intelligence

File Origin
# of uploads :
3
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24343.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6860bf2c187037363770ecc05ea33bfd181679a1ba982b1f7801737489e0cef0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-01 07:28:08 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbql6layoa3tmn3q5taf5iz37umbm6nbxkmcwh3yafzxjcpaz3ya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6860bf2c187037363770ecc05ea33bfd181679a1ba982b1f7801737489e0cef0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6860bf2c187037363770ecc05ea33bfd181679a1ba982b1f7801737489e0cef0

(this sample)

AgentTesla

Executable exe fb067717fc9d9a8023cf036649c4f5eedc7a37620ac1cfe7dc1369604d6e7217

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fb067717fc9d9a8023cf036649c4f5eedc7a37620ac1cfe7dc1369604d6e7217
  
Dropping
AgentTesla

Comments