MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2451df38893467098e419470ce3d5845239c03e6aa9f678bfba2d50c3d1455eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2451df38893467098e419470ce3d5845239c03e6aa9f678bfba2d50c3d1455eb
SHA3-384 hash: cc74456de39ddff905d847709dc2300c2a6e0e3efdde2e6d26acb8266097ca46d99785f4e0c6f846f74a7b6ba4bb9378
SHA1 hash: 274a344bd24b025eb85ed1e1c1fffda114c0a0ba
MD5 hash: ca3b347d2d14a55905c58d64675e0482
humanhash: failed-sierra-march-blossom
File name:AWB Shipment Document BL,INV and Packing.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:583'342 bytes
First seen:2020-08-12 15:21:04 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:rEz7bYMABpjV2p02dHjtRqzq/ZjEi+1u5MMSVUIRsclPkwjMj:YzoNwhBRquWi+A5M0icwjE
TLSH ACC42308CE9EBB561C524F65186A0B43BBCCFF179D942107EDCE0E6E2DB942A0B7D815
Reporter abuse_ch
Tags:AgentTesla DHL Hostwinds r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-759636.hostwindsdns.com
Sending IP: 104.168.135.22
From: info@vaiapan.com
Subject: DHL international GmbH,AWB 3245888693- Shipment Notification
Attachment: AWB Shipment Document BL,INV and Packing.r01 (contains "AWB Shipment Document BL,INV and Packing.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2451df38893467098e419470ce3d5845239c03e6aa9f678bfba2d50c3d1455eb/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:22:09 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eri56oejgrtqtdsbsrym4pkyiurzya7gvkpwpc73ulkqypiukxvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2451df38893467098e419470ce3d5845239c03e6aa9f678bfba2d50c3d1455eb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 2451df38893467098e419470ce3d5845239c03e6aa9f678bfba2d50c3d1455eb

(this sample)

AgentTesla

Executable exe efa3422b648b4ad5e66a973700c15abc250b772f9e699565c86909f817b54396

  
Dropping
MD5 cefcdb40cd445a79b109e34a667793fc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 efa3422b648b4ad5e66a973700c15abc250b772f9e699565c86909f817b54396

Comments