MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 397e437773de554b3da3e6bf58ccffa1c65c5106eecfd8bb06e35460c2bf0b30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 397e437773de554b3da3e6bf58ccffa1c65c5106eecfd8bb06e35460c2bf0b30
SHA3-384 hash: f183c3891e14e88b855cd0ea8992b5467b0b75df0e1b77ce95ebaa11470f5530b1acb5be39b2f4c691f5b293bbb969aa
SHA1 hash: 293724bcd27dd1c16ed410d35eaee3a5cb9df701
MD5 hash: ca02574062dcf5597a2bf6006428dcdc
humanhash: saturn-august-mobile-nebraska
File name:NAVIO SAGA FREYA VOY 09SF - TOTAL EMBARCADO.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'487 bytes
First seen:2020-08-08 08:16:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dLJEmWkAtmJ3nmC0XqfK7x9s1z7+UvTXfYkkRUMHT:3LWp0XmJXeK7xSLbXP0J
TLSH DE842386DDCC4D82BC8447496603343B22B699FAB46638316CEFEED945D3B7BB012A15
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.sosshost.ro
Sending IP: 212.146.114.140
From: Jonathan - SWN Brasil <exportacao@swnbrasil.com.br>
Reply-To: Jonathan - SWN Brasil <exportacao@swnbrasil.com.br>
Subject: NAVIO SAGA FREYA VOY 09SF: CAPATAZIA E TAXA LIBERAÇÃO DE BL - INV. 0028/20
Attachment: NAVIO SAGA FREYA VOY 09SF - TOTAL EMBARCADO.rar (contains "NAVIO SAGA FREYA VOY 09SF - TOTAL EMBARCADO.exe")

AgentTesla SMTP exfil server:
smtp.epaindemgroup.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/397e437773de554b3da3e6bf58ccffa1c65c5106eecfd8bb06e35460c2bf0b30/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:18:09 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hf7eg53t3zkuwpnd427vrth7uhdfyuig53h5royg4nkgbqv7bmya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/397e437773de554b3da3e6bf58ccffa1c65c5106eecfd8bb06e35460c2bf0b30

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 397e437773de554b3da3e6bf58ccffa1c65c5106eecfd8bb06e35460c2bf0b30

(this sample)

AgentTesla

Executable exe 180ce11458278937df159f820915e1c2d50fa5ef54542253aa3e076ac91fc5c3

  
Dropping
MD5 6bf5cffc3ccc4b7f9a2026750b047e12
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 180ce11458278937df159f820915e1c2d50fa5ef54542253aa3e076ac91fc5c3

Comments