MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0eef2c2b369c9c9e409700574d9c580b2a644efba350036753cad6e535383f3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0eef2c2b369c9c9e409700574d9c580b2a644efba350036753cad6e535383f3a
SHA3-384 hash: a42e28f1454dc4e99ab4553ffbfe8ebbfcc3416a062a1e5b95701a605309f7375dfe7ecb414e2de49452e88ec8fa375f
SHA1 hash: d263c38901ed9adf1885dcf5089e8dbeb0cf74d8
MD5 hash: 08045b544d5735c4faf789e1105ad2c7
humanhash: foxtrot-alanine-juliet-ohio
File name:sElectronic Flight Ticket Booking Payment Confirmation XXXX7383929837 Debit BNC9929302.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:586'343 bytes
First seen:2020-08-31 08:30:07 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:J6+jE6LqFTgi7fTWUsWUf4zL7onKduUVdGQJD:vjE6+ei7aUsWQ4zL7onpEdGQR
TLSH 5EC433CD42B0CFE7C97B3201651F58758B41F1A6BDF46A223BD1CA3F09A6FDA2A02505
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ptmatsuo.co.id
Sending IP: 202.74.72.84
From: My Trips <retail@lasfragancias.com>
Subject: Tickets Confirmed!
Attachment: sElectronic Flight Ticket Booking Payment Confirmation XXXX7383929837 Debit BNC9929302.xz (contains "sElectronic Flight Ticket Booking Payment Confirmation XXXX7383929837 Debit BNC9929302.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0eef2c2b369c9c9e409700574d9c580b2a644efba350036753cad6e535383f3a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 00:13:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3xsykzwtsoj4qexablu3hcybmvgitx3uniagz2tzlloknjyh45a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0eef2c2b369c9c9e409700574d9c580b2a644efba350036753cad6e535383f3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 0eef2c2b369c9c9e409700574d9c580b2a644efba350036753cad6e535383f3a

(this sample)

AgentTesla

Executable exe 677c3ed89ae8bde6abe34f5982e3ccd9f56092058ecf38ef6c269aa27db724fb

  
Dropping
MD5 a313715a67912e72f42be5a0bbb08026
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 677c3ed89ae8bde6abe34f5982e3ccd9f56092058ecf38ef6c269aa27db724fb

Comments