MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a1e3c7973d91fb9eb2aeec9cba6cb6950a331c2714e5e10d0b9bd1a06aef177. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a1e3c7973d91fb9eb2aeec9cba6cb6950a331c2714e5e10d0b9bd1a06aef177
SHA3-384 hash: e49bfa7b5fc761e347158fa0a52b6dbc1b37495de8162f4bc370223828772821b097dd9ba5a011151a2433e7897030cb
SHA1 hash: 0b805abb0c89bcbe9b7749700be9878af6ceabef
MD5 hash: a8f658f8b10478206ac20bce1c3afdcc
humanhash: texas-cold-kilo-timing
File name:Mediform SA Order 18_08_2020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:485'148 bytes
First seen:2020-08-19 12:49:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gqYyQujgd2MTIHDBhcQnNIuMEM+3mLqKVL6fsvQWYG:gqrQuo2MTIHDByQnTA+mL1QG
TLSH 2BA423E39685A9D70D6AC5C902B870A34D586FDE21A24A04B7C3FF407447BC8E95AF1F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serve0.tacadenaplc.pw
Sending IP: 104.168.253.8
From: Mediform S.A<mediform.s.a@hotmail.com>
Subject: Re:Fw: Request For New Inquiry RFQ
Attachment: Mediform SA Order 18_08_2020.rar (contains "Mediform SA Order 18_08_2020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a1e3c7973d91fb9eb2aeec9cba6cb6950a331c2714e5e10d0b9bd1a06aef177/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 12:51:05 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ripdy6lt3ep3t2zk53e4xjwlnfikgmocofhf4egqxg6rubvo6f3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8a1e3c7973d91fb9eb2aeec9cba6cb6950a331c2714e5e10d0b9bd1a06aef177

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8a1e3c7973d91fb9eb2aeec9cba6cb6950a331c2714e5e10d0b9bd1a06aef177

(this sample)

AgentTesla

Executable exe d3027dd8d1fd1dc823baace52ec28189ed1486065438d86c640199f4d98d3f79

  
Dropping
MD5 95446dc4233f4dbcfe3a714b94a16436
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3027dd8d1fd1dc823baace52ec28189ed1486065438d86c640199f4d98d3f79

Comments