MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a22f0c29452099b1d3ea7062c32f54c55d95db8455d7dd831cf82297cd0a61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28a22f0c29452099b1d3ea7062c32f54c55d95db8455d7dd831cf82297cd0a61
SHA3-384 hash: 02c45b0369bafdb71fbfbe667171a4ee1fc003128a40c7c803137eeb30d922ac73afc9755520e2d87181e1cccffda273
SHA1 hash: e144762a3ebaaf9c9b73b57bcecdb36d162d81db
MD5 hash: 7334c295f7ecb693931f98cf642eb2e0
humanhash: london-carpet-august-lactose
File name:FISH GROUP PTE LTD RFQ 180797-AFL00120.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:556'973 bytes
First seen:2020-08-17 06:09:07 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:TyVUfDofxDMUVyXf5g0MSv7mUzyzrn7aoXhVsb8Qb:TVLyDpVyP9y3moROAQb
TLSH D4C42373E2026F417C1C61D9D8BD5CAF7773AE4F1216014CD93AAD82880ABCBCB5A395
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vm86.entorno.es
Sending IP: 195.162.18.227
From: Sky Sim <sky.sim@fishsingapore.com>
Subject: F.I.S.H GROUP PTE LTD : RFQ 180797-AFL/001 - Frozen Cuttlefish whole round (Non-soaked) + Hoso Bt shrimps, 2x20Ft CNF Antwerp, Belgium
Attachment: FISH GROUP PTE LTD RFQ 180797-AFL00120.r00 (contains "Quotation Request Frozen food Supply Tender 45890502020.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28a22f0c29452099b1d3ea7062c32f54c55d95db8455d7dd831cf82297cd0a61/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 03:45:22 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcrc6dbjiuqjtmot5jygfqzpktcv3fo3qrk5pxmddt4cff6nbjqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/28a22f0c29452099b1d3ea7062c32f54c55d95db8455d7dd831cf82297cd0a61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 28a22f0c29452099b1d3ea7062c32f54c55d95db8455d7dd831cf82297cd0a61

(this sample)

AgentTesla

Executable exe e8bff638ab741d8bd757836e38d34c8813a7b1b37cc051f176c322ec7e03b9e6

  
Dropping
MD5 772570beebca539f17ff21c3ad453e5b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e8bff638ab741d8bd757836e38d34c8813a7b1b37cc051f176c322ec7e03b9e6

Comments