MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29876321efb1ef1a5063da6bd76da066201f486bc8f267e1f584dc117bac8e84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29876321efb1ef1a5063da6bd76da066201f486bc8f267e1f584dc117bac8e84
SHA3-384 hash: 93b0cef80439f592aac7fd1a760e976448a6bab0c1a504e494e56dc1e0554b2d11e0456084b745fe176e4e46862a5283
SHA1 hash: 9daf605c590a49fccf5fb9b004c185fa70d880d3
MD5 hash: 0783676df27f2d1132762090ecc17a36
humanhash: five-zebra-nuts-idaho
File name:DOC RFQ 8736229_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:174'372 bytes
First seen:2020-07-03 06:34:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:x+AOVWUpyXQE5Zim6LCZxnzd8p7zccraMGA+GSckVuiUtBVGd8z8:9qWCyXxZim6WZn8Oo7GDzckgG9
TLSH D0042371EB88F4D146379490AF5DBB42A334BDE98424C79868319EB341E0AFB1426B76
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: li1640-29.members.linode.com
Sending IP: 172.104.60.29
From: Noman Khan <norman.khan@siscosaudi.com>
Reply-To: norman.khan@siscosaudi.com
Subject: RFQ-0715-ARAMCO ABQAIQ PROJECT REQUIREMENT - SISCO
Attachment: DOC RFQ 8736229_pdf.zip (contains "DOC RFQ 8736229_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29876321efb1ef1a5063da6bd76da066201f486bc8f267e1f584dc117bac8e84/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:36:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgdwgippwhxruudd3jv5o3namyqb6sdlzdzgpypvqtobc65mr2ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 29876321efb1ef1a5063da6bd76da066201f486bc8f267e1f584dc117bac8e84

(this sample)

AgentTesla

Executable exe 071e686cfd7588fdc60e84ef03716534b7a2de1f3afe5d6bbda95fcd223ab334

  
Dropping
MD5 3f78c8f4d93353c515c1fcb15c73c9e5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 071e686cfd7588fdc60e84ef03716534b7a2de1f3afe5d6bbda95fcd223ab334

Comments