MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b688c093f4f58c09331eb0424f3cd090a4005e284761d4e61001d625d7808e82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b688c093f4f58c09331eb0424f3cd090a4005e284761d4e61001d625d7808e82
SHA3-384 hash: d371d0b7e06fe16abefd32d8417f90b1d364329ff3a4c16d6be2b1b2c6dc98c27c9ec4738265b5f55234718713290b2b
SHA1 hash: ba8ee2f511b2ed86808f16a0187c049ce88c186a
MD5 hash: a45e7418190ae655b4d963b01c45fe31
humanhash: utah-vermont-single-river
File name:Invoices.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:780'389 bytes
First seen:2020-08-05 06:39:48 UTC
Last seen:2020-08-05 06:40:22 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:FawLzZhAghl4AIgNcKQUlleUAPiewHi5h+cEmHLzYYbmzghvYIGC2JN5FdloWc4X:3vZr74SNcKfOUBri5hzYMbA3ria41vZM
TLSH 35F4232E8AC66CC5E2684318E9E04F1E8E0F6C43604BF79A6D4C6F1CCD67125FF4A865
Reporter abuse_ch
Tags:AgentTesla GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vps.hond-red.xyz
Sending IP: 45.95.169.93
From: info@hond-red.xyz
Reply-To: info@hond-red.xyz
Subject: About the Shipments
Attachment: Invoices.zip (contains "Invoices.scr")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1GIykafZbADzbhWZKlE8iE9t-KPHqw54u

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Backdoor.MSIL.Bladabindi.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23380.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23382.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b688c093f4f58c09331eb0424f3cd090a4005e284761d4e61001d625d7808e82/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:41:04 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w2embe7u6wgasmy6wbbe6pgqscsaaxrii5q5jzqqahlclv4ar2ba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b688c093f4f58c09331eb0424f3cd090a4005e284761d4e61001d625d7808e82

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b688c093f4f58c09331eb0424f3cd090a4005e284761d4e61001d625d7808e82

(this sample)

GuLoader

Executable exe 77168234eb706333e4835666a00a8fd8e110959660c97e5c5528ed3a3d0f5081

  
URLhaus
https://urlhaus.abuse.ch/url/424595/
  
Dropping
MD5 2d94c040e86b88ba44b8315d1df6d608
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77168234eb706333e4835666a00a8fd8e110959660c97e5c5528ed3a3d0f5081
  
Dropping
SHA256 31be102bbdf34c472e7f3476cdecab45c76d3dc20b6e6d6ad92686f330deb280
  
Dropping
MD5 21bc9887f1cb7485f147298b0c05485f

Comments