MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4dd809ef7b62945f513de235fef1665fad3cfd0b4efb56c170c03502bde36280. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4dd809ef7b62945f513de235fef1665fad3cfd0b4efb56c170c03502bde36280
SHA3-384 hash: 851fb6b931511d4b82f4bd90bbae4ed486afb0204f97d12713aa2fb8f9d277de38c94c9993d337d98643d701c29624ff
SHA1 hash: 982f3043ee24b71b54eda54509adc60a501a24e5
MD5 hash: 873b2359aa7f239f9815166c5c33019f
humanhash: october-mississippi-finch-eight
File name:INVOICE_2203320045_xlxs.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:498'410 bytes
First seen:2020-08-18 12:06:34 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:RsS9299R81dP+6+zkueoGgUKDKToDy0AGphIiz/N57mj:cfm1R+66VewUKDKTsVOibj7mj
TLSH FAB4236936D8E9ECDB1D100BB6163927956D8DD6A3C0DDCB89BDC9E107CC23A7388097
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Accounts <airtechint@cyber.net.pk>
Subject: URGENT
Attachment: INVOICE_2203320045_xlxs.gz (contains "INVOICE_2203320045_xlxs.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4dd809ef7b62945f513de235fef1665fad3cfd0b4efb56c170c03502bde36280/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:08:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxmat333mkkf6uj54i2754lgl6wtz7ilj35vnqlqya2qfppdmkaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4dd809ef7b62945f513de235fef1665fad3cfd0b4efb56c170c03502bde36280

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4dd809ef7b62945f513de235fef1665fad3cfd0b4efb56c170c03502bde36280

(this sample)

AgentTesla

Executable exe af27bd7180ad756460e32f2ae56db7cbdc8a79e73a36b261a96f803e5b051fd5

  
Dropping
MD5 dd108215d60d63656303ca265f03fade
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af27bd7180ad756460e32f2ae56db7cbdc8a79e73a36b261a96f803e5b051fd5

Comments