MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07bc3536fcffde5f8ea6064d1ac2c8807de0e280247b0432b67dab965ea0a49d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07bc3536fcffde5f8ea6064d1ac2c8807de0e280247b0432b67dab965ea0a49d
SHA3-384 hash: 3ba790f4f453d9fcc9293c524b7d7df64136263bb7d4830d71ff3317c00b4d08fb686d9af200c1099f300463895863fe
SHA1 hash: dc5b7657d386e99b7fad1834f991e501e136bfed
MD5 hash: e7210579524fdd04bbf1395ce11f1138
humanhash: edward-whiskey-music-delaware
File name:Announcement 290121 - Glossary.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:574'774 bytes
First seen:2021-04-04 15:15:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Qfgk21dusbsJeTTN7siYGN7JktHMyBPxLgzqpd4b6QSyXscs6CqminZy1a/iS:QWdLbswtsip5JktHMi8WHpnTD6CqmAQS
TLSH 7DC423E78130E6F27248A2E3FC6BA1054B5606BBDD0CE728E6D01984D539257F8DEDD8
Reporter cocaman
Tags:AgentTesla DHL zip


Avatar
cocaman
Malicious email (T1566.001)
From: "dgfid marketing (DHL ID) <dgfid.marketing@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [217.146.88.165]) "
Date: "03 Apr 2021 12:19:56 +0200"
Subject: "=?UTF-8?B?REhMIEdsb2JhbCBGb3J3YXJkaW5nIEN1c3RvbWVyIEFkdmlzb3J5IOKAkyBDT1ZJRC0xOSBFQ1JTIFVwZGF0ZSA1?="
Attachment: "Announcement 290121 - Glossary.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
265
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.623-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/07bc3536fcffde5f8ea6064d1ac2c8807de0e280247b0432b67dab965ea0a49d
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-04 16:06:09 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a66dknx477pf7dvgazgrvqwiqb66byuaer5qimvwpwvzmxvausoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 07bc3536fcffde5f8ea6064d1ac2c8807de0e280247b0432b67dab965ea0a49d

(this sample)

AgentTesla

Executable exe 0872a1be0db0ddeab0c9d4d52d457d76f5a0a02239bbe31882e5d7493af9992c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0872a1be0db0ddeab0c9d4d52d457d76f5a0a02239bbe31882e5d7493af9992c
  
Dropping
AgentTesla

Comments