MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40151935e2ef36fcee043a7894c72edf458442a8c23c4652b78a90f1c6de863e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40151935e2ef36fcee043a7894c72edf458442a8c23c4652b78a90f1c6de863e
SHA3-384 hash: 80dda8825d3a568c7b231da796a7c50ab4604d915136ec7d621467f853aa564af5878f24002aeba83ccea2f89f65618b
SHA1 hash: fafccf6d57565a059229138bace6e95a75ef2112
MD5 hash: bdc0210ffa87c153b704cf13f9788d4e
humanhash: sad-artist-september-yankee
File name:Paymentsoftcopy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:439'536 bytes
First seen:2021-01-04 17:59:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:UKAf2PXWj1KhniP6uXJ07VSpReyECgduxyTO:UKAOPQTdJ07V/y3gkeO
TLSH DD9423B512104FC3BA45D92B265A277F293AAF44C83026F2981C7F4B5C2D60B97778DE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: secure.zrl.com.zm
Sending IP: 216.194.164.118
From: AXIS BANK <merchantstatement.service@axisbank.com>
Subject: Axis Bank - Payment Advice For MEID : 000022370370586
Attachment: Paymentsoftcopy.zip (contains "Paymentsoftcopy.cmd")

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.43883.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40151935e2ef36fcee043a7894c72edf458442a8c23c4652b78a90f1c6de863e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 18:00:05 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iakrsnpc543pz3qehj4jjrzo35cyiqviyi6emuvxrkipdrw6qy7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
Link:
https://yomi.yoroi.company/submissions/40151935e2ef36fcee043a7894c72edf458442a8c23c4652b78a90f1c6de863e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 40151935e2ef36fcee043a7894c72edf458442a8c23c4652b78a90f1c6de863e

(this sample)

AgentTesla

Executable exe 98712ca737a8d8cddc09bd41dbae64ccc816d5a846da270615108bac7023e19d

  
Dropping
MD5 daf5314c9480548c49e8d7f2c864e7e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98712ca737a8d8cddc09bd41dbae64ccc816d5a846da270615108bac7023e19d

Comments