MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61a724032ad9d409ce000cdc2c6b4b80e5b9ad35e326f656fa687b71ab033ac2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61a724032ad9d409ce000cdc2c6b4b80e5b9ad35e326f656fa687b71ab033ac2
SHA3-384 hash: 33b58e5b51505321a10840df88f2d56b7422c79894d8028b6d60462d9bc8c5153866a7a019a57a8b3e0618d1eaaa6d1b
SHA1 hash: f5a74712830e8950a19a72d0a5bca6d7693be4f5
MD5 hash: 553742b70d969491aca1601080500cc0
humanhash: south-montana-october-six
File name:delivery report20200616,pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:378'054 bytes
First seen:2020-06-16 05:58:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:KrvkXWI1hhU0NVcWG7uD2KFEKhF3lwWM9DtMNHqb/3GsKTF+5Tj9QgdX1Cbww:oyWIF7DNG7JK+2W9Dt4Kbv/5H9dnOD
TLSH 098423E7B14301D4B6B3D624F5096AC64902A92798FDF4AFBF8230DD49F26A04ED25D3
Reporter abuse_ch
Tags:AgentTesla CHN geo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lsleds.com
Sending IP: 156.96.45.138
From: 高磊 <sales10@lsleds.com>
Reply-To: pinlapgeatan@gmail.com
Subject: 关于青岛中集合同的事宜20GPX1000
Attachment: delivery report20200616,pdf.z (contains "delivery report20200616,pdf.exe")

AgentTesla SMTP exfil server:
mail.bioaktif.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 06:00:06 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgtsiazk3hkattqabtocy22lqds3tljv4mtpmvx2nb5xdkydhlba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 61a724032ad9d409ce000cdc2c6b4b80e5b9ad35e326f656fa687b71ab033ac2

(this sample)

AgentTesla

Executable exe 6004fc4f391186e55a2438890b178eb5a5509d3730deebd3c2cef940feba1397

  
Dropping
MD5 39a0d67cde0d4c93a4a055282fc65b09
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6004fc4f391186e55a2438890b178eb5a5509d3730deebd3c2cef940feba1397

Comments