MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46c68af388cc55899546cce76ed9c42980cd1bce2c62f85d4c043486faa376ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46c68af388cc55899546cce76ed9c42980cd1bce2c62f85d4c043486faa376ab
SHA3-384 hash: 050c5c3f94cefdd7d1ec5210f40bbe0ebe4d7d11aac0f865f84fa16c7a663e6cf32e051f1bd65030e6eedd95a445d36e
SHA1 hash: 6df7da5cc71a55ab273bd3ed38ab16540136597b
MD5 hash: efc27088fd99d88133bbe9a23cdacebd
humanhash: idaho-ohio-kitten-low
File name:PO-713594.xlxs.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:457'069 bytes
First seen:2020-10-22 06:56:22 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:QUQwyXtNis/AKk5bMVjRLrJhHUgMdtPMB:YX9cLhwlv0gMdFMB
TLSH F6A423D7CD662080955D35ACB5E89CF01E9372CE3B037624985E73E2E77D1089BDA127
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: d004f5-tecnosys.sphostserver.com
Sending IP: 185.81.0.33
From: Sales <booking@caladelporto.com>
Subject: Order
Attachment: PO-713594.xlxs.cab (contains "PO-713594.xlxs.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46c68af388cc55899546cce76ed9c42980cd1bce2c62f85d4c043486faa376ab/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 00:19:09 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3div44izrkytfkgzttw5woefgam2g6ofrrpqxkmaq2in6vdo2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 46c68af388cc55899546cce76ed9c42980cd1bce2c62f85d4c043486faa376ab

(this sample)

AgentTesla

Executable exe df1fd43f5e715d4b610466b4cc55331d3978e1f771c3991d9844c72345a5abbb

  
Dropping
MD5 9dba35b4aad244bb8af595226b188d23
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df1fd43f5e715d4b610466b4cc55331d3978e1f771c3991d9844c72345a5abbb

Comments