MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7ef9d00a64506ea574f09f65b85882d684e7aed28fc02526e0e03ba60c623cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7ef9d00a64506ea574f09f65b85882d684e7aed28fc02526e0e03ba60c623cd
SHA3-384 hash: 016fdbe869af93484da878a37bda17af710c474af7dab636f8f9c9a7a2edf2585a99c08a62455b02f58de23e38f70fb5
SHA1 hash: 4d367e7a3885695bd691f06d131452c8636b340b
MD5 hash: 5e27476912ab1b8fa1e1752640e58857
humanhash: mike-nineteen-double-monkey
File name:invoice.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'508 bytes
First seen:2020-05-28 14:35:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:aBDj3mFdjgWIXITAzS3/kwRI7yh5VGq95JB1xQaQKr+OFuO/vaSzCU:ahj3S7IXITAevxAorxmBO/ySzCU
TLSH 3084236D7BB0775D956E8D1C9B80A803CB648B700D6274FBE5144C3EC9A8ADD67C0E4B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hosting-a01.descom.es
Sending IP: 54.194.66.61
From: Admon <emilone@flowtechinc.com>
Subject: PAYMENT OF THE BALANCE
Attachment: invoice.pdf.rar (contains "invoice.pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 15:03:20 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f7ef9d00a64506ea574f09f65b85882d684e7aed28fc02526e0e03ba60c623cd

(this sample)

AgentTesla

Executable exe d8d45bcdf17fe5bdf30789b7af5e92d7c28a70ba64f3bd7e09f100ef1ce30281

  
Dropping
MD5 1df401d38083c9886d00b9c052096083
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8d45bcdf17fe5bdf30789b7af5e92d7c28a70ba64f3bd7e09f100ef1ce30281

Comments