MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 430add7554a711b388455a6ba6bbb66561b71acba290066c4e026d474699ad91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 430add7554a711b388455a6ba6bbb66561b71acba290066c4e026d474699ad91
SHA3-384 hash: 2c72b8ee05cdac6b111119f81a55142aec69573a977c7a8b87169e29b9ff4c8fc892368a9e5b02a7f64a484f7e899801
SHA1 hash: ea09a9dbf9b36225b78e1ea6ee95c4f1d0def311
MD5 hash: f99117d705d94467188646b58bcffb10
humanhash: pizza-delta-hotel-maryland
File name:PROFORMA INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'154 bytes
First seen:2020-08-31 08:54:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Y0XjJz91L9E7T2KOU7FviKI/+O6hpq1bPrx24cKoUx5YyIZsX6oSe:YKJXL9ASK35i1gpWP44DojyI6XhZ
TLSH 40C4335E1763B968083B4138ECA804A3F76E3E0EE1EDA35DF23F8A9F904956497D05C1
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outbound-gw.openxchange.ahost.me
Sending IP: 94.136.40.163
From: danny@gms.scot
Reply-To: danny@gms.scot
Subject: PROFORMA INVOICE
Attachment: PROFORMA INVOICE.zip (contains "PROFORMA INVOICE.exe")

AgentTesla SMTP exfil server:
smtp.dedhivala.com:587

AgentTesla SMTP exfil email address:
cs@dedhivala.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/430add7554a711b388455a6ba6bbb66561b71acba290066c4e026d474699ad91/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 02:52:34 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=imfn25kuu4i3hccfljv2no5wmvq3ogwlukiam3coajwuoruzvwiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/430add7554a711b388455a6ba6bbb66561b71acba290066c4e026d474699ad91

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 430add7554a711b388455a6ba6bbb66561b71acba290066c4e026d474699ad91

(this sample)

AgentTesla

Executable exe f02fa74cf67fbbbff605bf316388b5c6d208efd33ccede87538938389be4de93

  
Dropping
MD5 ea19169a2545d3330527bd2c463395e8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f02fa74cf67fbbbff605bf316388b5c6d208efd33ccede87538938389be4de93

Comments