MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd054232902f94a76d66128ad553e7a3acc79d8c8b83459851393f4c2350c0b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd054232902f94a76d66128ad553e7a3acc79d8c8b83459851393f4c2350c0b8
SHA3-384 hash: 739f526b9a0b36cff60d0646c3316bc070f8f439e15a0912cc6b86e5a7a3f21e7ffbee6ea9b60acf816ae44a91eec626
SHA1 hash: 84b0ec9cdfa9f50218957cfe82b5b57aba5ff8ce
MD5 hash: d8406e275782c3500056e22a8ad87309
humanhash: alpha-fruit-pip-bacon
File name:Purchase Order Ref MYRAM-BDM-10752-POR-001.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:481'224 bytes
First seen:2020-08-06 05:55:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:3VV2k7iS5BP9A5CizSF7XmNKuUKP1eb+Ja+93:3b2Yic9A5CizSpJ0P1eIVB
TLSH 07A423579A7D6BE48AAD6A34EE0E9BED3770CBC3A70C4534B58124B317582E0BD61C21
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: te.techniserv.live
Sending IP: 45.95.171.132
From: Aiman Aziz <aiman.aziz@myram.com.my>
Reply-To: Aiman Aziz < info@techniserv.live>
Subject: Purchase Order Ref : MYRAM-BDM-10752-POR-001
Attachment: Purchase Order Ref MYRAM-BDM-10752-POR-001.zip (contains "Purchase Order Ref MYRAM-BDM-10752-POR-001.exe")

AgentTesla SMTP exfil server:
smtp.jonnywilliam.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd054232902f94a76d66128ad553e7a3acc79d8c8b83459851393f4c2350c0b8/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 03:33:18 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ucuemuqf6kko3lgckfnku7huowmphmmrobulgcrhe7uyi2qyc4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd054232902f94a76d66128ad553e7a3acc79d8c8b83459851393f4c2350c0b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fd054232902f94a76d66128ad553e7a3acc79d8c8b83459851393f4c2350c0b8

(this sample)

AgentTesla

Executable exe 749b5bf46ac62e2f4c947f36095ef8e1277d36771f41a289a6a6c852972489d8

  
Dropping
MD5 18bf0b95d4cb1a94b95d8ce3bf48ec0b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 749b5bf46ac62e2f4c947f36095ef8e1277d36771f41a289a6a6c852972489d8

Comments