MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cacfb5234c7f08db6af7fee43de78ac39ba98aadfdc0c539cff8e83af4b40468. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cacfb5234c7f08db6af7fee43de78ac39ba98aadfdc0c539cff8e83af4b40468
SHA3-384 hash: d86005272f45b20b92bb0c9ce0e1bd86c4b600c5974d258ee387384cb9210ce19ce5f00931eccfd0d6e304f73b5de601
SHA1 hash: e7d9c3f8a0823f764af57749036e9e1fe9d61ca2
MD5 hash: f05decdff8409cbfebd6c670730efcae
humanhash: kitten-berlin-steak-sixteen
File name:메탈로직 - 20.08.15 - F2005027 - W34,435,000,pdf.7Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:502'983 bytes
First seen:2020-08-14 09:47:35 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:LAUjMC1fKaxZ5YxqXen81JufhmNTmpFRg+jpJtCalQJkXMYr4+/O:pjMfMqqunGJufENTCFR7j3EapL4r
TLSH D5B423F33A466386FFEAC00F195A5AD61868E450A09E83971371EBD301D7E74F0EA94D
Reporter abuse_ch
Tags:7z AgentTesla geo KOR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cvsmtppost023.nm.naver.com
Sending IP: 125.209.224.212
From: 최정환<yj78655@naver.com>
Subject: 와이어컷팅 도면
Attachment: 메탈로직 - 20.08.15 - F2005027 - W34,435,000,pdf.7Z (contains "메탈로직 - 20.08.15 - F2005027 - W34,435,000,pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cacfb5234c7f08db6af7fee43de78ac39ba98aadfdc0c539cff8e83af4b40468/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 09:49:04 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlh3ki2mp4enw2xx73sd3z4kyon2tcvn7xamkoop7dudv5fuarua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cacfb5234c7f08db6af7fee43de78ac39ba98aadfdc0c539cff8e83af4b40468

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z cacfb5234c7f08db6af7fee43de78ac39ba98aadfdc0c539cff8e83af4b40468

(this sample)

AgentTesla

Executable exe 090c34db70dec6ff92806425a51c8d1c562eb12146a145e3a272e103200be32b

  
Dropping
MD5 8fd1ee69b14ca7ea1214fffcf6191d57
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 090c34db70dec6ff92806425a51c8d1c562eb12146a145e3a272e103200be32b

Comments