MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242
SHA3-384 hash: c9aeb4757eb9f43cb2bf45759053f15ce939af601fc0ce495de4a1838bbf25e782619e8ff2f8875c10430dc95edb34e5
SHA1 hash: eaa7c868ddaa0b976ed6b6ea542d2fbbcd1b62c1
MD5 hash: 1b22ed6be579d51c798487aab95f85c4
humanhash: iowa-virginia-twenty-salami
File name:MPO-003234.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:558'155 bytes
First seen:2021-02-23 08:21:24 UTC
Last seen:2021-02-26 03:59:46 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:25krMb04tBNV/Q34ror9h9dX+yBnQ0Gz5uZ/Slcp93aHT:2et4tBa4roxnIgQRgkQ93yT
TLSH EDC423AF9731D10BDFB22672E799327066F8BB1B9D06F84D48103FA40747564AF9AD80
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Rahul I Atop Solution LLC <coordinator@acs-dxb.com>" (likely spoofed)
Received: "from acs-dxb.com (unknown [217.146.81.124]) "
Date: "23 Feb 2021 09:10:23 +0100"
Subject: "Quotation required-Urgent"
Attachment: "MPO-003234.zip"

Intelligence

File Origin
# of uploads :
6
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn46.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 08:22:08 UTC
File Type:
Binary (Archive)
Extracted files:
57
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=igt2y3s5ecglgplzsbew23rql2tweijdryjy6nwwoevxkdekqjba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242

(this sample)

AgentTesla

Executable exe cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93

Comments