MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2d1d88a334b5df558a90dfd652e6cd180e0f2a1c12259be03fdde334cc79fe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2d1d88a334b5df558a90dfd652e6cd180e0f2a1c12259be03fdde334cc79fe2
SHA3-384 hash: b22b219370b64fefc42cfb34ea6e4ebbb0a608b6a0888e8733480d16411764aa0056961076e7007a379a4409b6d743d1
SHA1 hash: 7c324bca1bbf4542466a17ee12a65d9996dd823d
MD5 hash: 682c9d72225a49eff2085ef2358d598e
humanhash: monkey-winter-earth-uncle
File name:INVOICE_483263737936.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'717 bytes
First seen:2020-07-29 05:22:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:L9R/rkJFnEK/W4fc/uzRHH1dnYxNskZmwzKYMf/Ioy:jqFd1dH1gvxGR/IV
TLSH 40A423D5025AA5ABD22ED0D791D39C2EB412A2C1A33E17E40E594DCC172BC5D6BCE28F
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Lina Tabbello <lina.tabbello@abdalimedical.com>
Received: from cloudhost-505127.us-midwest-1.nxcli.net (cloudhost-505127.us-midwest-1.nxcli.net [104.207.254.173])
Date: Wed, 29 Jul 2020 01:15:10 +0100
Subject: RFQ for Materials
Attachment: INVOICE_483263737936.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.21146.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2d1d88a334b5df558a90dfd652e6cd180e0f2a1c12259be03fdde334cc79fe2/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 05:24:09 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yli5rcrtjno7kwfjbx6wkltm2gaob4vbyerftpqd7xpdgtght7ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2d1d88a334b5df558a90dfd652e6cd180e0f2a1c12259be03fdde334cc79fe2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c2d1d88a334b5df558a90dfd652e6cd180e0f2a1c12259be03fdde334cc79fe2

(this sample)

AgentTesla

Executable exe f255241a0343f23d9e0b2fd5a3e81be32ac570b70404ff91b01536c8c9b055b3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f255241a0343f23d9e0b2fd5a3e81be32ac570b70404ff91b01536c8c9b055b3
  
Dropping
AgentTesla

Comments