MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27095e0485ad91d2e8a2a2393c92f534f12b8f51372f9aef49f60ab91cefb861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27095e0485ad91d2e8a2a2393c92f534f12b8f51372f9aef49f60ab91cefb861
SHA3-384 hash: 5eb9726fc1bac7e701438571700f50b54e293a7defe3126229bf39f7fe9f0d1a3972244eae495705e725c72a8392cb5a
SHA1 hash: 94cfc722fac14de93db3aefcff60ae88316e4e7c
MD5 hash: ddd3db1fb03ecbcbb8256d0e7e457be5
humanhash: carbon-sad-jersey-chicken
File name:Payment _Advice (2).rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:715'851 bytes
First seen:2021-04-08 05:24:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:rCkuG8HAgtMbupEeiORELE+cRTwwfWiv7Y65H08xe9aif6TF1roWvMS+P5u4IP:rCA2AeRKORccSwM65UcEaifipt+Pnq
TLSH A3E423075C8F1F5873F25A8CEF6893421357062B11AFA72429FF896228767C2CDD21E6
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Sunny Nie "<sales1@lekingwellness.net>" (likely spoofed)
Received: "from lekingwellness.net (unknown [180.214.239.97]) "
Date: "7 Apr 2021 12:02:48 -0700"
Subject: "Payment "
Attachment: "Payment _Advice (2).rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27095e0485ad91d2e8a2a2393c92f534f12b8f51372f9aef49f60ab91cefb861/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 00:45:09 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e4ev4befvwi5f2fcui4tzexvgtysxd2rg4xzv32j6yflshhpxbqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/27095e0485ad91d2e8a2a2393c92f534f12b8f51372f9aef49f60ab91cefb861

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 27095e0485ad91d2e8a2a2393c92f534f12b8f51372f9aef49f60ab91cefb861

(this sample)

AgentTesla

Executable exe 896a518b2db98d75130034be194d0c0295e00a5c310e068790599b69420b2f08

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 896a518b2db98d75130034be194d0c0295e00a5c310e068790599b69420b2f08
  
Dropping
AgentTesla

Comments