MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a20b3dc457857e9f77eb0648604fb344cc943dc2aaa90a38ec6f77207f067e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a20b3dc457857e9f77eb0648604fb344cc943dc2aaa90a38ec6f77207f067e9
SHA3-384 hash: c2d6f670304e47891d58aa0132f20b73161c199411fac3709387a7e1d575047958fd93e5dbaf869741d3f3145f58959c
SHA1 hash: 9f627dad04334a78d7aff2e86e22106a71e1b98b
MD5 hash: 9bbcf9007ad4dcb63a9386a12f5ac93f
humanhash: queen-bacon-oven-purple
File name:doc 20200528__0010019391001011.xlsx.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'427 bytes
First seen:2020-05-28 12:48:16 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:ZK34l2ib/I7Yd6HxbnykMi9XUVRFWs79vOkxE8CsMILzq+nQggRDOsdC3U70+d2H:ZW4lo7Ydy4iXcPllEXVeqS+OC7Bd21j9
TLSH 029423405CCB27D781542F70DBE9B2AEDAE5F53228B01458AD010AEB50498D389EB7FF
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: floridaproducts.com.ar
Sending IP: 156.96.62.213
From: Marcelo Estevez <import@floridaproducts.com.ar>
Subject: inqiury for quotation#/200528
Attachment: doc 20200528__0010019391001011.xlsx.r00 (contains "doc 20200528__0010019391001011.xlsx.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27214.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:38:07 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
6 of 48 (12.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 7a20b3dc457857e9f77eb0648604fb344cc943dc2aaa90a38ec6f77207f067e9

(this sample)

AgentTesla

Executable exe e3bfc6f40176d8546ae975991ee2fb59980cac07fecbfb273b2a8b51b33a3713

  
Dropping
MD5 e0bf473f651b68f3bb6efc6cc0cbbd74
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3bfc6f40176d8546ae975991ee2fb59980cac07fecbfb273b2a8b51b33a3713

Comments