MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4aa5279fa1c77a67c6b5a2bbd208eac6abe14a85f8af722062166644bc1440cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4aa5279fa1c77a67c6b5a2bbd208eac6abe14a85f8af722062166644bc1440cf
SHA3-384 hash: 99f5f662351ee3e0398f25959a1a0c5fb8af55e58a0576e0b687b005e9f15bb2f9bb6ebb2626333ba4afa2a3182c5876
SHA1 hash: 13184eac6e3675de303aec0431c5ad64d574cc42
MD5 hash: b26a425d4d5c5ddd79955ffbb2789d07
humanhash: connecticut-nineteen-magnesium-kilo
File name:Ref-080720.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'107 bytes
First seen:2020-08-08 08:15:01 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:uhJLANjAoDGVv9MEUP480krZ4j7uP1NAif+EWGeC+O3A:ZjAMa9aP4DHif+EACW
TLSH 7AA4237173BC39340AE4825D43BF79497F5E89A4145833A0F787AB3E6446ACFD9EA021
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ucmchile.cl
Sending IP: 185.222.57.157
From: Sandra Caro <scaro@ucmchile.cl>
Subject: Re: DEVOLUCIÓN DE PAGO TT (Ref No.08072020)
Attachment: Ref-080720.pdf.gz (contains "Ref-080720.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4aa5279fa1c77a67c6b5a2bbd208eac6abe14a85f8af722062166644bc1440cf/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:16:13 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkssph5by55gprvvuk55echky2v6csuf7cxxeidccztejpauidhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4aa5279fa1c77a67c6b5a2bbd208eac6abe14a85f8af722062166644bc1440cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4aa5279fa1c77a67c6b5a2bbd208eac6abe14a85f8af722062166644bc1440cf

(this sample)

AgentTesla

Executable exe 8f3ad5ccb61c668f7fbbc009cf0ea27396dd4fe80c0adb7b6daa86b136308252

  
Dropping
MD5 e64e479d2ab743321b3de2107b8b35a9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f3ad5ccb61c668f7fbbc009cf0ea27396dd4fe80c0adb7b6daa86b136308252

Comments