MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ca6094f26c01b9c4bff58dd951d7317030e95e65ba13570adfe1832bd06084b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ca6094f26c01b9c4bff58dd951d7317030e95e65ba13570adfe1832bd06084b
SHA3-384 hash: dfd2fcb1d57cecabc209ab97d53c967faff79b97a0ab584119f9662a2d9197b0f75aa69b8555ec604d7db9dc65182174
SHA1 hash: 34055f8c9fee048c8627aae3cbb09ff9981041df
MD5 hash: b402d072c863f2c7b44e952dcb60e8a9
humanhash: august-texas-september-maine
File name:Repeat Order 2020. PDF File.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:899'366 bytes
First seen:2020-08-19 06:54:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FwT02bgb0CfBdv3yOa0xAH4ebR86MgtG/spA6yGT3kxNl:Xz33PfAH4eLhtb+Pdl
TLSH C1153301B0F26C6CC656EE608DECD7B691849626B08E2EEC2D2A553F7FC6339D8504D7
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.gunasenaputra.com
Sending IP: 103.31.233.6
From: Luci Yulianti <luci.yulianti@gunasenaputra.com>
Subject: Re/:Re: Repeat Order
Attachment: Repeat Order 2020. PDF File.rar (contains "New Order 2020. PDF File.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ca6094f26c01b9c4bff58dd951d7317030e95e65ba13570adfe1832bd06084b/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 06:56:09 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rstastzgyanzys77ldozkhltc4bq5fpgloqtk4fn7ymdfpigbbfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8ca6094f26c01b9c4bff58dd951d7317030e95e65ba13570adfe1832bd06084b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8ca6094f26c01b9c4bff58dd951d7317030e95e65ba13570adfe1832bd06084b

(this sample)

AgentTesla

Executable exe aee0659a73d3ce6eaaeafcfe545290f95e8e52c3f640fca9fcdb984a17ee27c0

  
Dropping
MD5 45b1298dc7a0795c366aa8facded3a93
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aee0659a73d3ce6eaaeafcfe545290f95e8e52c3f640fca9fcdb984a17ee27c0

Comments