MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 371158c2013e818b98e1a7b776d99f4202975e453134389a552703af9655457b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 371158c2013e818b98e1a7b776d99f4202975e453134389a552703af9655457b
SHA3-384 hash: 781307a24a4b61ca6ee2e04d12082b1380d756fc8426ec25d628344fdc4118d708134d030d3685407b5f870d58131abd
SHA1 hash: dd71fdd4d17f9a05eec73f5b03b10af16d30f49a
MD5 hash: efd1abb7cd0502047150615ef0c29603
humanhash: michigan-bulldog-cold-cat
File name:Doc6620200947535257653.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:569'831 bytes
First seen:2020-10-27 10:17:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:88cGAyaAHe9qbWchxGeCMVTs/U+MaUbtVy3ppuoJw:8DGAymeLGgVQM4UxVCU
TLSH 91C423917FB8421587375D5AD53BF5842A5CC6C379ABB8E042F3AC0DDA63468026FAF0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [193.56.28.159]
Sending IP: 193.56.28.159
From: Purchase <purchase@arabico.ae>
Reply-To: hirschmanncompany@yahoo.com
Subject: URGENT QUOTATION - arabico company dubai
Attachment: Doc6620200947535257653.zip (contains "Doc#6620200947535257653.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.13466.30908.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/371158c2013e818b98e1a7b776d99f4202975e453134389a552703af9655457b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 04:00:46 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4ivrqqbh2ayxghbu63xnwm7iibjoxsfge2drgsve4b27fsviv5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 371158c2013e818b98e1a7b776d99f4202975e453134389a552703af9655457b

(this sample)

AgentTesla

Executable exe 385c7018cf8debb5955d9009f6c8096cecf124c975306b95c9b24bd84046e97b

  
Dropping
MD5 f850f94851cbd14037272872a18ca4e4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 385c7018cf8debb5955d9009f6c8096cecf124c975306b95c9b24bd84046e97b

Comments