MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0844c77fb975dd66016a3ce678094610256dc597740a46fce219cafcf5d21435. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0844c77fb975dd66016a3ce678094610256dc597740a46fce219cafcf5d21435
SHA3-384 hash: d9203a302a7d7325e2bc659e9a20dfb2357b17a5c7114686b39d25b7cbf504b38f474e47187b70785ca98a1fb89d86f1
SHA1 hash: bd221edff72a0a2226d971af3f2703c815573d98
MD5 hash: 767dc5889e48e284acc9b53689c8e2ee
humanhash: march-music-thirteen-snake
File name:PO.202315...pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'281 bytes
First seen:2020-05-12 05:56:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:rhbtKnc+mQoZkbjroHPoqZ4rnLUPW/Yc9M6m1:nOclxWovoI4DLUPGYc9S
TLSH 4794231E8ABABD40812AD50F7B56D1F202AAFC9DDC39170C32570A6FB9B5FC8722154D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: onececo.com
Sending IP: 212.114.52.238
From: Wendy <swzhao@onececo.com>
Subject: FW: PO.202315...pdf
Attachment: PO.202315...pdf.zip (contains "PO.202315...pdf.exe")

AgentTesla SMTP exfil server:
vps36800.inmotionhosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 07:31:30 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbcmo75zoxowmalkhtthqckgcasw3rmxoqfen7hcdhfpz5oscq2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0844c77fb975dd66016a3ce678094610256dc597740a46fce219cafcf5d21435

(this sample)

AgentTesla

Executable exe d58a3fea3dec563fd6c1f2d7c159b25d7d161c2b7c298f9b0226953e3ccb4e36

  
Dropping
MD5 7703f61f033db10e51eab07ec941b1b1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d58a3fea3dec563fd6c1f2d7c159b25d7d161c2b7c298f9b0226953e3ccb4e36

Comments