MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79822e8fbce1e6a1cab4239a370061182994525aad9b4851666a7b9f07c43de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79822e8fbce1e6a1cab4239a370061182994525aad9b4851666a7b9f07c43de9
SHA3-384 hash: 9762ca3dbbea5f0e2142bb1b5b32594e07cd6a31006c912c864b2162d13ef4574a2fd89bdeb4b12f431a4909bfb1313e
SHA1 hash: b7d6647bd497a5ccd315769c180dd692e9e5cc40
MD5 hash: 3e498468381a99f5538455573150d662
humanhash: equal-michigan-nevada-zulu
File name:70% Wire Confirmation Bank Slip ,,pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'900'544 bytes
First seen:2020-08-05 07:52:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:4ROqKHV71kzgTc+qVcCX1jlhQOJQ5Qc+UbrpwKpwx:4ROqKpegTc+vCX1j8OApRps
TLSH 4395E0616988DEA0CDFE0B31B6239400DFF1AC248F52E58DBDADF2BD2B736454916709
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lopificio.it
Sending IP: 103.153.76.116
From: Jessica<exsales@lopificio.it>
Subject: FW: RE: $76,320 Wire Confirmation.
Attachment: 70% Wire Confirmation Bank Slip ,,pdf.img (contains "70% Wire Confirmation Bank Slip ,,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79822e8fbce1e6a1cab4239a370061182994525aad9b4851666a7b9f07c43de9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:54:08 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgbc5d544htkdsvueondoadbdauzius2vwnuqulgnj5z6b6ehxuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79822e8fbce1e6a1cab4239a370061182994525aad9b4851666a7b9f07c43de9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 79822e8fbce1e6a1cab4239a370061182994525aad9b4851666a7b9f07c43de9

(this sample)

AgentTesla

Executable exe b1dfcf175d2aeff612c4aada38df796c1f4687caacd0b26e02f66485d5a32899

  
Dropping
MD5 9b1bb2f4434b35bd8542a275f4b52795
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1dfcf175d2aeff612c4aada38df796c1f4687caacd0b26e02f66485d5a32899

Comments