MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00f2c4199e5654b8ac7f2ac3bdf6c0aa8b690acc26396ad36bf3ab5580a5ab15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00f2c4199e5654b8ac7f2ac3bdf6c0aa8b690acc26396ad36bf3ab5580a5ab15
SHA3-384 hash: bf47b169b26483220ace200421c890928e338be49e9d8854848638bd8893f92de2e2b9496188f76a5fb71814edd1e1a6
SHA1 hash: e87f8126248ec2cfa74f82c65330a2f593ec3184
MD5 hash: d061aeceff69389ce3eb454ab54e1860
humanhash: asparagus-bulldog-mango-yellow
File name:doc7000001657.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:509'302 bytes
First seen:2020-10-12 19:32:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:b6QnIaKZzVV6eb5OlbuZvhV5HYrpD1xHFbyLe:b6QneZ5/b5OklhIdD1FZWe
TLSH CBB423210D2B1BBA52D43C0F1C59C02F44B9ED3F94E096E3E26BB7D2B346751A67B068
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: OPTONLINE.NET
Sending IP: 178.211.52.231
From: Ananad Lakaj - Purchase Mgr - AAMOR CIFG LIMITED <anand.l@OPTONLINE.NET>
Subject: order no.7000001657 from AAMOR CIFG LIMITED
Attachment: doc7000001657.pdf.zip (contains "doc7000001657.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.445.16624.30742.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00f2c4199e5654b8ac7f2ac3bdf6c0aa8b690acc26396ad36bf3ab5580a5ab15/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 14:50:35 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=adzmigm6kzklrld7flb335wavkfwscwmey4wvu3l6ovvlaffvmkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/00f2c4199e5654b8ac7f2ac3bdf6c0aa8b690acc26396ad36bf3ab5580a5ab15

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 00f2c4199e5654b8ac7f2ac3bdf6c0aa8b690acc26396ad36bf3ab5580a5ab15

(this sample)

AgentTesla

Executable exe 8b2922e2bcc7a62dfc599f4d0690194fe6db96b1b116a708291a2def48ded44e

  
Dropping
MD5 6e9d1cab5da2f2717bde835cafc17ecf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b2922e2bcc7a62dfc599f4d0690194fe6db96b1b116a708291a2def48ded44e

Comments