MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4397420c0db71a117903ac5be006c050d5dbd3d2d3c2e574aa02ba5480ed955b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4397420c0db71a117903ac5be006c050d5dbd3d2d3c2e574aa02ba5480ed955b
SHA3-384 hash: d7b5b64714aee8b24da5083f02bd49d5a4cd4c807ba2023948a43b61e695d0d366c78a54d0800944a8d97994a6626664
SHA1 hash: 712a430c5a34c14a253f35ebde63dc9e970c06e6
MD5 hash: 7467d6cef742a3ffe4a5409c79c413d6
humanhash: comet-xray-mobile-uncle
File name:pictures.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:233'556 bytes
First seen:2020-07-02 06:32:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:d1d5zQ5K2XcbV7HVZVKN20GdulI6w7/P8NzAjstoObJOum75Lr1pvBD9waf5CtUV:dAcZBZy+dul4EzUstosJvM5/rvBSBUK4
TLSH 4D342324B9E9DAED4A945B39F1F70F97418CAB4032CD3BD1488A8CF16A3DB11441BCC9
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: auth5.cpanel.net
Sending IP: 185.106.209.4
From: Javier Páramo Álvarez <info@antalyacomputest.com.tr>
Subject: RE: New Order Inquiry For July 25/2020 shipping
Attachment: pictures.zip (contains "pictures.scr")

AgentTesla SMTP exfil server:
bh-31.webhostbox.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21677.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4397420c0db71a117903ac5be006c050d5dbd3d2d3c2e574aa02ba5480ed955b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:34:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ioluedanw4nbc6idvrn6abwakdk5xu6s2pbok5fkak5fjahnsvnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4397420c0db71a117903ac5be006c050d5dbd3d2d3c2e574aa02ba5480ed955b

(this sample)

AgentTesla

Executable exe ff556834b215cb5dc865342178c6e15e015cee26d4b601710c58264c5c76ba21

  
Dropping
MD5 0879e42f499d25bc6651cef6c74e2c42
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff556834b215cb5dc865342178c6e15e015cee26d4b601710c58264c5c76ba21

Comments