MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00f1cac035969d9afb7be8561432e20da4c3042bd8e8181393f83b710d6b36a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00f1cac035969d9afb7be8561432e20da4c3042bd8e8181393f83b710d6b36a0
SHA3-384 hash: 8fedefe482f4427ab4d4c5838ac05551d2bfa0c35d61ac70483f6c314717d7e096397966ad2624b34750e0d28c2cfd64
SHA1 hash: 7eaf2891a8e6ffbf358829474fd4502c786a9877
MD5 hash: b4f401deb9fe7208c9adc63a0f67fe4b
humanhash: hotel-winter-kitten-speaker
File name:Quotation for MRS-KNRP-6842F.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'054 bytes
First seen:2020-08-06 06:42:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:cVOiijI/5ezTsso6DmVemvGNO+c5exjysk+Gh:CijIAcemOuessU
TLSH 7AA42367BA1DD464F29C1FD71B0BFE80B2E6AED7CF40640B541022844F4AF9646BC567
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hdec.co.kr
Sending IP: 95.211.253.201
From: Reyaz Anwar <reyaz1109@hdec.co.kr>
Subject: Request for Quotation for MRS-KNRP-6842FT
Attachment: Quotation for MRS-KNRP-6842F.rar (contains "Quotation for MRS-KNRP-6842F.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00f1cac035969d9afb7be8561432e20da4c3042bd8e8181393f83b710d6b36a0/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:44:23 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ady4vqbvs2ozv6335blbimxcbwsmgbbl3dubqe4t7a5xcdllg2qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/00f1cac035969d9afb7be8561432e20da4c3042bd8e8181393f83b710d6b36a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 00f1cac035969d9afb7be8561432e20da4c3042bd8e8181393f83b710d6b36a0

(this sample)

AgentTesla

Executable exe de1821510757235dc806cf0083de1d80517ad438b1178edb1b95378503545c6c

  
Dropping
MD5 bccc24d1b27b8a422a50b30632063871
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de1821510757235dc806cf0083de1d80517ad438b1178edb1b95378503545c6c

Comments