MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac28c687bc62d48c6a0c183c13a13be5c8dd7da525599a3bc39585e00cf55d03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac28c687bc62d48c6a0c183c13a13be5c8dd7da525599a3bc39585e00cf55d03
SHA3-384 hash: 7febf849aee20da0e335f9102c879a239a605f3bc6d5e6af328a452af1a1c18db74f9c96d0e095907b2e61f51e916465
SHA1 hash: 781c8a6f55ce7b2bba0e117a920d04cf9590d361
MD5 hash: 5ed4d9c89ad26755e753eda4e7043476
humanhash: fifteen-cup-bacon-mountain
File name:Final Shipping Documents.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:659'886 bytes
First seen:2020-09-04 13:02:38 UTC
Last seen:2020-09-04 13:03:49 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:V5pRi72sO8L+bBDZvy/wlWrvXtCV36xdBn6JiX+8JmG:VnhoL+lEY0rVCN2eiu88G
TLSH 47E423550D4AC0294FDC02FCE5F57C55EA9EB18A7CFB83B3C64809BFA229711128E697
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Sang Liangjuan <ovs8.sha@bestservices.com.cn>
Received: from properso.com (62-210-157-138.rev.poneytelecom.eu [62.210.157.138])
Date: Fri, 04 Sep 2020 12:36:40 +0100
Subject: RE: RE: RE: FINAL SHIPPING DOCUMENTS URGENT//
Attachment: Final Shipping Documents.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac28c687bc62d48c6a0c183c13a13be5c8dd7da525599a3bc39585e00cf55d03/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-04 02:25:13 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vqumnb54mlkiy2qmda6bhij34xen27nfevmzuo6dswc6adhvlubq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ac28c687bc62d48c6a0c183c13a13be5c8dd7da525599a3bc39585e00cf55d03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ac28c687bc62d48c6a0c183c13a13be5c8dd7da525599a3bc39585e00cf55d03

(this sample)

AgentTesla

Executable exe 14f5a4291505c26453b17f8f81861a861b6af3c5d25447f409137220383dd14d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14f5a4291505c26453b17f8f81861a861b6af3c5d25447f409137220383dd14d
  
Dropping
AgentTesla

Comments