MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97ece1c5994701a9837030f6a356fdc5e17845731b8aae2783e5b1ea02e3456d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97ece1c5994701a9837030f6a356fdc5e17845731b8aae2783e5b1ea02e3456d
SHA3-384 hash: 7d08c8d692c0785f255e2313d5005e66054c00dbf667fe6d6e0d5bbd2b7096e4c8b21191d49023eb814b02536f1cb733
SHA1 hash: a48313ea7c56adaf51ac0b2b0cbd05f9583248e0
MD5 hash: e79b7d2cd29d18353004a32a70bbb0d0
humanhash: cold-wisconsin-quiet-white
File name:Official PO.ARJ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'677 bytes
First seen:2020-08-06 07:57:44 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:52KwjPEnRRb60E0fEVpw0FUSG3bXFPkMiBvNNBq4A3qbh0zTFgluu10fPzCt+mfz:nc2b6I22RPkhTc4v0zKaCQmEFctATX2H
TLSH 93B4239731C1BC885D2F934A56DD91E65CBA1E821028C4FD0FCD73097BA6A7CCB93629
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hshgroups.co
Sending IP: 104.168.166.26
From: Joyce Lee<sxdfzc@hotmail.com>
Subject: FIRST ORDER FROM SEAWAY CHINA TRADING
Attachment: Official PO.ARJ (contains "tlNoFXoObJ2gr4u.exe")

AgentTesla SMTP exfil server:
mail.sardaplywood.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97ece1c5994701a9837030f6a356fdc5e17845731b8aae2783e5b1ea02e3456d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 07:59:10 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7wodrmzi4a2ta3qgd3kgvx5yxqxqrltdofk4j4d4wy6uaxdivwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97ece1c5994701a9837030f6a356fdc5e17845731b8aae2783e5b1ea02e3456d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 97ece1c5994701a9837030f6a356fdc5e17845731b8aae2783e5b1ea02e3456d

(this sample)

AgentTesla

Executable exe 073eae12581d9a39dd51d0669465ceb20309a4de8f61866b0df6d449db6996a7

  
Dropping
MD5 211bfb6d1652b84b74bd964c410883ec
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 073eae12581d9a39dd51d0669465ceb20309a4de8f61866b0df6d449db6996a7

Comments