MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7b132c23c2a8b8f5ee414fdd3ccf88d5f4d9ef103e73da364e7929fc94d38a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7b132c23c2a8b8f5ee414fdd3ccf88d5f4d9ef103e73da364e7929fc94d38a8
SHA3-384 hash: 3eca5acfddd6850a319bd3ae0b768ef2f47d5a500510489138ede3a5665155ba39211ad8c5dc000a1c6532acea8dcec2
SHA1 hash: 0af3828ca46d4e4778e5622eea7a0a72c0d6eae7
MD5 hash: c41e634a15adc82503423fd311f15a3d
humanhash: mountain-echo-april-nevada
File name:Oferta OF-201208.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:558'492 bytes
First seen:2020-08-12 18:32:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:S3HkpSPFv6RhQ33stk2W8rqorlg0V4kGb2Lv3m/hX2BethglLZSyXct4H:SXkYPFv+CZpoxruGpGyLu5XwethRyMaH
TLSH 2BC423C35904B4AA3A8DF99753BA70DAEF814B75C82D2C6E1D4C9106DB301A5FF3CA80
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blue104.dnsmisitio.net
Sending IP: 186.64.119.226
From: Pedro Fabbri <pfabbri@bruening.cl>
Subject: RE: Oferta Comercial
Attachment: Oferta OF-201208.zip (contains "Oferta OF-201208.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.RSharedStrings.13377.7692.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7b132c23c2a8b8f5ee414fdd3ccf88d5f4d9ef103e73da364e7929fc94d38a8/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 18:34:06 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6ytfqr4fkfy6xxect65hthyrvpu3hxraptt3i3e46jj7sknhcua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c7b132c23c2a8b8f5ee414fdd3ccf88d5f4d9ef103e73da364e7929fc94d38a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c7b132c23c2a8b8f5ee414fdd3ccf88d5f4d9ef103e73da364e7929fc94d38a8

(this sample)

AgentTesla

Executable exe 3d7463ce4864f02ca4b9db4adbad0e5c3733c027592bd1f696375fe892688b3c

  
Dropping
MD5 b351716a108f0c0cc80674e2b00bf7be
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d7463ce4864f02ca4b9db4adbad0e5c3733c027592bd1f696375fe892688b3c

Comments