MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74fef2f276f159b431bb45a86235b218bd7414043be4f3180e22470d4f61695c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 74fef2f276f159b431bb45a86235b218bd7414043be4f3180e22470d4f61695c
SHA3-384 hash: e63a274701a27ac91ff98145935ec313c088d244cf69db536310df1edaa6a466c83ddd8500199bd853f1111924c4580a
SHA1 hash: 3dbf3ca7025047d00a4517daa45c7b2a4a0e4bef
MD5 hash: 222ff9a853959fec7a41aa57befb1cf2
humanhash: timing-nevada-victor-louisiana
File name:doc010984202006241001152449.gz
Download: download sample
Signature AgentTesla
File size:234'916 bytes
First seen:2020-06-30 05:23:11 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:ohLKb3hSfcDEB9czzE43qVV85b22iNNejQ0gt:W6xou3qVV13Nl0gt
TLSH 3F34236A3B94AE990B91649FFCD85D573204443D081F3AC85FE16CBD09F090EA785F6E
Reporter @abuse_ch
Tags:AgentTesla gz


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: se2h-iad1.servconfig.com
Sending IP: 173.231.248.14
From: Ahtesham Khan <Ahtesham.Khan@olayangroup.com>
Reply-To: asokfreyi@gmail.com
Subject: Re: OC 100848606 Re: New Order - PO20000022
Attachment: doc010984202006241001152449.gz (contains "doc010984202006241001152449.exe")

AgentTesla SMTP exfil server:
smtp.faithhopaendimages.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 32
Origin country US US
ClamAV SecuriteInfo.com.CAP_HookExKeylogger.15485.24281.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/74fef2f276f159b431bb45a86235b218bd7414043be4f3180e22470d4f61695c/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Wacatac
First seen:2020-06-30 05:25:04 UTC
AV detection:18 of 48 (37.50%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 18.03%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 74fef2f276f159b431bb45a86235b218bd7414043be4f3180e22470d4f61695c

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments