MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84c677b854c6b710f5b9cf64d0f1a077302199ede566c90da69792e11ef40349. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84c677b854c6b710f5b9cf64d0f1a077302199ede566c90da69792e11ef40349
SHA3-384 hash: 83a1e02bf26653634d5db5b4f2f0ddf534f03d3783d8d9b9d8cf1c274751ea7ef55003ecee4f2f8eb150dca3d664b3ea
SHA1 hash: 22b13081504f2556cbac52a3684e73a61e967c2c
MD5 hash: e9ff1f778a8af2eede393ecc07ef9b7e
humanhash: red-bakerloo-carpet-twelve
File name:Swift Copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:595'074 bytes
First seen:2020-10-20 08:41:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:RGVv2YGUFsEWTowN2PxqsZy5Y/rjyvRbXNsPAQUFqgs/Kjzgsz7y/:QVcUFsIwCQsj3yv5GJUFDsKjzgs7y/
TLSH 15C42347991BAB77C44CECFB4BEDBF9AF7B8AA71040E6DF265D403C0840C992A192057
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.akhtargroup.com.bd
Sending IP: 50.31.147.37
From: Zhonglong Materials Group Co., Ltd <sales11@zpigments.com>
Reply-To: purchasemd@yandex.com
Subject: Zhonglong's Greetings from China/Swift Copy
Attachment: Swift Copy.zip (contains "Swift Copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20816.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84c677b854c6b710f5b9cf64d0f1a077302199ede566c90da69792e11ef40349/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 02:23:44 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qtdhpocuy23rb5nzz5snb4nao4ycdgpn4vtmsdngs6jochxuaneq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84c677b854c6b710f5b9cf64d0f1a077302199ede566c90da69792e11ef40349

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 84c677b854c6b710f5b9cf64d0f1a077302199ede566c90da69792e11ef40349

(this sample)

AgentTesla

Executable exe 9dac8c618a01c75a4b8b1e26b4a3198c832d8230a5788fb1ccf1e2e8d7d8001c

  
Dropping
MD5 d5b5dc61ab67fdcb65b5686a57a088e0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dac8c618a01c75a4b8b1e26b4a3198c832d8230a5788fb1ccf1e2e8d7d8001c

Comments