MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 173b2b183171f07ad25df261ee28917e816fa2e66415b85b218a93fb9475b71e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 173b2b183171f07ad25df261ee28917e816fa2e66415b85b218a93fb9475b71e
SHA3-384 hash: f391256c84b0b421d7540f3f6ea6a899d9e47c0c92fce46c3891daff3b7ce4f9da1dbdaf2385d69920c40afafbfdf8d4
SHA1 hash: 90aaba49dd00f42f9a65d8cd5e66bbb8d717a715
MD5 hash: 975ce460c13ae69391c31bd6ac8ca977
humanhash: stream-double-east-minnesota
File name:INV.PL.PAYMENT ADVICE.PDF.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'467 bytes
First seen:2020-06-29 04:59:30 UTC
Last seen:2020-06-29 07:37:24 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:mGQAALeNnttCQ9tElXRwifnK6/cP6TQq+MhtIM9E1LHLhGVWeIi7FSyhnkPY2x:mGrE4ivK6k1zMwM9e5WIi7fkPHx
TLSH 8A8423B170F1E74BBB3B95482CFE64B50B623F54730E5D2888B8652EA590D28C2D7F64
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/173b2b183171f07ad25df261ee28917e816fa2e66415b85b218a93fb9475b71e/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 03:39:30 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c45swgbrohyhvus56jq64kerp2aw7ixgmqk3qwzbrkj7xfdvw4pa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 173b2b183171f07ad25df261ee28917e816fa2e66415b85b218a93fb9475b71e

(this sample)

AgentTesla

Executable exe 953cb68c8860e2ed1d79f3eb57820c7a04e30d9f0f7d5db7364b2369449fdd27

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 953cb68c8860e2ed1d79f3eb57820c7a04e30d9f0f7d5db7364b2369449fdd27
  
Dropping
MD5 aca22a271bbb4322d02d9429225f190f

Comments


Avatar
Corsin Camichel commented on 2020-06-29 07:39:43 UTC

Malicious email
From: Eva Huang <overseas18@riologistics.cn>
Received: from riologistics.cn (unknown [185.222.58.152])
Date: 29 Jun 2020 07:56:52 +0200
Subject: Re: SOA
Attachment: INV.PL.PAYMENT ADVICE.PDF.Z