MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0836fcf780ad598756f435dd3995c7354304d31aac6e1c3d419c614e549ba3f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0836fcf780ad598756f435dd3995c7354304d31aac6e1c3d419c614e549ba3f5
SHA3-384 hash: bc3e5f8bf82f2664d7638954b066503e2a3be960d6d89bacc10170fbcff715c556a6665c46f95c1b73b34a15e8fc3c2a
SHA1 hash: 6b840f6474d75c1db04f7bdc9776d30ba13369d8
MD5 hash: fabb30a61279c9b58176cdae16a53309
humanhash: single-berlin-july-johnny
File name:Invoice 000852.pdf.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:254'952 bytes
First seen:2020-07-06 06:34:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:NynaMGo/gEPYoDWnRIUO5cUYR78vmKdTraAphdMrDOOwgQzUoUIryM:MnPjAoWRIrunR7lKdTrhNOwgQ4o7rh
TLSH 5244232BECEB923BC33A532AED95A8DAB24C45D6651406305169334BD25B43FCCD0DCB
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sunucu.soholine.com
Sending IP: 77.223.142.192
From: "CHUNHUA 王秀英Wang Xiu Ying" <shvape@163.com>
Subject: FW : Payment against Invoice No
Attachment: Invoice 000852.pdf.xz (contains "Invoice 000852.pdf.exe")

AgentTesla SMTP exfil server:
smtp.hostnet.nl:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24016.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0836fcf780ad598756f435dd3995c7354304d31aac6e1c3d419c614e549ba3f5/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 06:36:05 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ba3pz54avvmyovxugxottfohgvbqjuy2vrxbypkbtrqu4ve3up2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0836fcf780ad598756f435dd3995c7354304d31aac6e1c3d419c614e549ba3f5

(this sample)

AgentTesla

Executable exe 0a4ac915ba6f8c018081c160cd3bf260b2b96d9d4f9a0505398e2aff62b09318

  
Dropping
MD5 3479962882434b33203aa7efa4a8f7d3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a4ac915ba6f8c018081c160cd3bf260b2b96d9d4f9a0505398e2aff62b09318

Comments