MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 133e49a00e691007f27f86894235dde2041b34e563708dd395c5be26a5d63d25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 133e49a00e691007f27f86894235dde2041b34e563708dd395c5be26a5d63d25
SHA3-384 hash: 5739f00fc62e08ed9919d49b44c3b77142e6d0cca004a4e045c5b5bf5218314aa6bc6b88b0b6e9b2d2896b52eabe6028
SHA1 hash: 5b0fdc1c24286151820f8767a225a6f9b1bb329b
MD5 hash: f6070d29dee84125cb82a1569861ecea
humanhash: purple-skylark-march-oklahoma
File name:Invoice Pdf copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'086 bytes
First seen:2020-06-29 07:49:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:1ppY7vT9S5l/SgaRtP2SPsgPscPCTi+aiYVg8P5LkaJEOeWV:JY7pS5NSj2SUgPzay1VgQXRV
TLSH 889423CD58F2568EF0B82A03038A03657D3E590C0FDF64A5D6CD918DD2E7E06A9596FC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s111-ir-cpanel-trade.maindns.net
Sending IP: 185.165.116.18
From: Martina Esposito <pt.silbers@yahoo.com>
Reply-To: sales.silbers@gmail.com
Subject: Copy Of Payment!!
Attachment: Invoice Pdf copy.zip (contains "Invoice Pdf copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24016.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/133e49a00e691007f27f86894235dde2041b34e563708dd395c5be26a5d63d25/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:51:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cm7etiaoneiap4t7q2eueno54icbwnhfmnyi3u4vyw7cnjowhusq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 133e49a00e691007f27f86894235dde2041b34e563708dd395c5be26a5d63d25

(this sample)

AgentTesla

Executable exe 738acd1b73b637e5aabce4ba985c985ba24917066adb94dd0773a7498649ad5d

  
Dropping
MD5 2c1caba3c49e463b8725d3dbfe7ce092
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 738acd1b73b637e5aabce4ba985c985ba24917066adb94dd0773a7498649ad5d

Comments