MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f917c6e2910fcef51abd05b8cd8c7ff73d3b5aef9c410040e4a8c546a7618549. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f917c6e2910fcef51abd05b8cd8c7ff73d3b5aef9c410040e4a8c546a7618549
SHA3-384 hash: fa51891c86240547246c5c7ff53d4c0a0e52d229bcb31c61b1ed7354094837b7c5d4ec2978076bb0bb50c1ce0978a9d9
SHA1 hash: 52d1342d9c9c09d2404d6c2299b918693e45ec15
MD5 hash: b52400c489c42c57b651d10de9c253db
humanhash: kansas-stairway-cup-sierra
File name:Order & Prices Confirmation.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'001 bytes
First seen:2020-06-09 11:50:11 UTC
Last seen:2020-06-09 13:16:28 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:UE6x4mtsHwvi3ZuXZeXeYbw54CzXY9KURGcCB2i+F5YM:UKIc3UXcc54MIkUwVwYM
TLSH 309423F9945572E206DCB5268F43FF019D66ACA5FA8909CF504834AFD26B44B40B9CF3
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 11:52:05 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7el4nyurb7hpkgv5aw4m3dd7646twwxptraqaqhevdcunj3bqveq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f917c6e2910fcef51abd05b8cd8c7ff73d3b5aef9c410040e4a8c546a7618549

(this sample)

AgentTesla

Executable exe 0386ca207e4e3915f24fe4974d8a43abee3425f01ab452be6875b9ddadab75f5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0386ca207e4e3915f24fe4974d8a43abee3425f01ab452be6875b9ddadab75f5
  
Dropping
MD5 b0cbbfda9530e587e6f57b78f702a7ca

Comments