MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 589c5026b51eb23525ea0c18d3f66d5cd49108ace9990e743f2904e2e06a36bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 589c5026b51eb23525ea0c18d3f66d5cd49108ace9990e743f2904e2e06a36bf
SHA3-384 hash: c1336d5926c7504ac965875b737f1f655f1e8a9cca39a506ce45bee797b3dca99ced7d0188e4ca2345c0d93c122ffbe4
SHA1 hash: 1d2c3100d3e0ea6768c165070606c486509a304e
MD5 hash: e950f5156ea8d185cf61b56f62c896a0
humanhash: north-south-venus-whiskey
File name:Payment Copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:785'698 bytes
First seen:2020-08-04 11:11:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Zyl14SCJ9M9f4cEcb3/2fwdO2caOI8CR3LqM3M2xrNFWZ7CmB8Jn/iHinR1ugH9a:YlpO9QQ30/24d3caOq/MaDkCK8J/iORC
TLSH 2EF43308DF8539A5C71147EA819D99C0882D413BF7127E4DE82EDADF23EC6E93D3194A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 10749host.inkahosting.pe
Sending IP: 201.148.107.49
From: contabilidad@santotomas.com.pe
Subject: Re: Payment Copy
Attachment: Payment Copy.zip (contains "Payment Copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21237.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/589c5026b51eb23525ea0c18d3f66d5cd49108ace9990e743f2904e2e06a36bf/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:13:07 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcofajvvd2zdkjpkbqmnh5tnltkjccfm5gmq45b7fecofydkg27q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NJRat
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/589c5026b51eb23525ea0c18d3f66d5cd49108ace9990e743f2904e2e06a36bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 589c5026b51eb23525ea0c18d3f66d5cd49108ace9990e743f2904e2e06a36bf

(this sample)

AgentTesla

Executable exe b598c7c48f10c889b428a265396073f9ae33717566c1fae28c9a8d83406e3573

  
Dropping
MD5 bd3ee670700347cce285f828da1bc926
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b598c7c48f10c889b428a265396073f9ae33717566c1fae28c9a8d83406e3573

Comments