MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e91dc417454396e51f6008731d7c7ef32d8e1f5c68bf40b4a6bd745bc9510ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e91dc417454396e51f6008731d7c7ef32d8e1f5c68bf40b4a6bd745bc9510ef
SHA3-384 hash: bf9bf4b04ea14343c4d722059500dff37ffaf488f285636b2b683dbbb18fc9854a9225fdb1cce94e67e1d0dcb617bfc5
SHA1 hash: 4443a97e1118c400291695dcf311730187039eee
MD5 hash: b3f9ea22cc6ffb7e2666eb8e29af4660
humanhash: golf-video-four-ink
File name:FINAL PAYMENTS.PDF.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:618'745 bytes
First seen:2020-10-02 09:08:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:JswIcjczW8Y2dSkP42Ja55cw7xly1xWjoi7jr6X33PnILRK8ams9L1j2Lni73AYQ:HIZS8NdSQ4Gwaixcajoqjr6H3vIa1a+k
TLSH 73D423512D67162FB5E3C0B64292CD23ACC69F82BC71708424E2CF7B65735D6A68ACF1
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pctlautomation.com
Sending IP: 37.48.85.241
From: PCTL Automation Ltd. <accounts-3@pctlautomation.com>
Subject: RE: 70% PAYMENT
Attachment: FINAL PAYMENTS.PDF.Z (contains "FINAL PAYMENTS.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.373.2347.9543.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e91dc417454396e51f6008731d7c7ef32d8e1f5c68bf40b4a6bd745bc9510ef/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 07:15:57 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2i5yqlukq4w4upwacdtdv6h54znrypvy2f7ic2knplulpevcdxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e91dc417454396e51f6008731d7c7ef32d8e1f5c68bf40b4a6bd745bc9510ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2e91dc417454396e51f6008731d7c7ef32d8e1f5c68bf40b4a6bd745bc9510ef

(this sample)

AgentTesla

Executable exe 266aba3c76dc29ae2cdc7340079dcb6e73f2638bbfc6e1df805641edaae68efd

  
Dropping
MD5 6c2052b09a10e09614ed08ccbb06d8a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 266aba3c76dc29ae2cdc7340079dcb6e73f2638bbfc6e1df805641edaae68efd

Comments